Authenticate a missing name or type
03DNSSEC must prove negative answers as well as existing records.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 3.2 ↗
RFC 4033 · § 3.2EXAMPLE
3 / 3
03
Validate the denial before treating absence as authenticated.
Validate the denial before treating absence as authenticated.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
NSEC provides authenticated denial of name or type existence in this document family.
- NSEC provides authenticated denial of name or type existence in this document family.
- A plain NXDOMAIN response without a validated proof does not establish authenticated absence.
The drawing is a simplified worked example. Follow the linked RFC and its updates for implementation requirements.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy