What is the purpose of NSEC3 in DNSSEC?

Question

Options

• ATo provide information about DNSSEC key signing keys
• BTo prevent zone enumeration
• CTo authenticate a DNS server
• DTo sign a DNS zone

• A
  3% (1)
• B
  92% (33)
• C
  6% (2)

Explanation

NSEC3 (Next Secure Record version 3) solves a specific privacy problem in DNSSEC: without it, an attacker could walk the chain of NSEC records to enumerate every hostname in a zone. NSEC3 replaces plaintext next-name pointers with hashed name values, making it computationally infeasible to reverse-enumerate all domain names in a zone - this is zone enumeration prevention (B).

Why the distractors are wrong:

• A (key signing keys): That's the role of DNSKEY records, which store public keys used in the signing chain.
• C (authenticate a DNS server): DNSSEC authenticates DNS data, not servers. Server identity is handled by protocols like TLS/DANE.
• D (sign a DNS zone): Signing is done by RRSIG records, which hold cryptographic signatures over resource record sets.

Memory tip: Think of NSEC3 as putting a mask (hash) over zone names - it proves a name doesn't exist without revealing what names do exist. The "3" is the upgrade from NSEC that added hashing specifically to block zone walking.

No community discussion yet for this question.