Help & Troubleshooting
NSEC Record
What this is
NSEC records provide authenticated denial of existence in DNSSEC-signed zones: they prove a name or type genuinely does not exist by linking each name to the next one in sorted order.
How to read your result
Seeing no NSEC records is normal — unsigned zones have none, and many signed zones use NSEC3 instead. NSEC answers mostly appear when querying names that do not exist.
Common problems and how to fix them
Zone contents can be enumerated (zone walking)
How it shows up: Anyone can list every hostname in your zone by following NSEC links — exposing internal names like vpn.example.com or staging hosts.
How to fix it: Switch the zone to NSEC3 (hashed names) at your DNS provider, and avoid putting genuinely sensitive hostnames in public DNS at all — NSEC3 raises the effort but is not encryption.