NSEC Record Look Up
Related tools
What this is
NSEC records provide authenticated denial of existence in DNSSEC-signed zones: they prove a name or type genuinely does not exist by linking each name to the next one in sorted order.
How to read your result
Seeing no NSEC records is normal — unsigned zones have none, and many signed zones use NSEC3 instead. NSEC answers mostly appear when querying names that do not exist.
Common problems and how to fix them
Zone contents can be enumerated (zone walking)
How it shows up: Anyone can list every hostname in your zone by following NSEC links — exposing internal names like vpn.example.com or staging hosts.
How to fix it: Switch the zone to NSEC3 (hashed names) at your DNS provider, and avoid putting genuinely sensitive hostnames in public DNS at all — NSEC3 raises the effort but is not encryption.
Related reading
- DNS Record Types, ExplainedA practical tour of every DNS record you will actually touch — A, AAAA, CNAME, MX, TXT, SRV, CAA, the DNSSEC set and the modern HTTPS record — with syntax, gotchas and when to reach for each.
- Checking DNSSEC: How the Chain of Trust Works and Where It BreaksA practical guide to DNSSEC - how ZSK, KSK, DS, RRSIG and DNSKEY records form a chain of trust, why domains break, and how to check your status.
Frequently asked questions
- What is an NSEC record?
- NSEC (Next Secure) is a DNSSEC record that provides authenticated denial of existence, proving that a queried name or record type does not exist in a signed zone. Each NSEC record points to the next name in canonical order and lists which record types are present at the current name.
- How do I use this tool?
- Enter a domain name and run the lookup; the tool queries the zone server-side and shows any NSEC records returned, including the next domain name in the chain and the type bitmap. Nothing you enter is stored, and lookups run on our servers rather than in your browser.
- Why do NSEC records matter?
- Without them, an attacker could forge a "this name doesn't exist" reply for a DNSSEC-signed domain, so NSEC lets resolvers cryptographically verify that a nonexistent name truly is absent. This closes a spoofing gap that plain DNS cannot protect against.
- How do I read the result?
- Look at the "next" name to see where this record sits in the zone's sorted chain, and read the type bitmap to see which records (such as A, MX, or RRSIG) exist at this name. An empty result usually means the zone is not DNSSEC-signed or uses NSEC3 instead.
- What is a common limitation of NSEC?
- Because NSEC lists the actual next name in each response, an attacker can "walk" the entire zone and enumerate every hostname in it. This privacy weakness is why many zones use NSEC3, which hashes the names, so an NSEC lookup may return nothing even on a signed domain.