The zone's record names can be enumerated
What this check looks for
Your zone proves that a name does not exist by naming the next one that does. Following that chain lets anyone list every hostname in your zone.
Why it matters
This is a disclosure, not a vulnerability, and it is exactly how NSEC was designed to work. It matters only if you have hostnames whose secrecy is doing security work — a staging site, an admin panel, an internal service — which is a weak defence anyway, but one you may be relying on without realising.
What it costs your score
This check never deducts. It reports a fact — or reports that something could not be verified — and is shown on the report without moving the score.
- Severity
- info
- Default confidence
- confirmed
- Status when triggered
- info
- Deduction
- 0 points
- Family cap
- none
- Category
- DNSSEC
- Module
- Dns dnssec
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Switch to NSEC3 if the names in your zone should not be public.
NSEC lets anyone enumerate every hostname you have published.
Decide whether any hostname in the zone is protected only by being unknown. If none is, NSEC is the better choice and no change is needed.
If some are, enable NSEC3 at your DNS host with 0 iterations and no salt, per RFC 9276.
Better still, remove the reliance on obscurity: put the service behind authentication.
How to confirm it worked
dig +dnssec nonexistent-name.‹domain› — expect NSEC3 records rather than NSEC
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
‹domain› uses NSEC for authenticated denial of existence. RFC 4034 §4 defines NSEC as pointing to the next name in canonical order, which allows the zone to be walked one query at a time. NSEC3 (RFC 5155) hashes the names to make walking harder, at the cost of extra work per query. Neither is wrong; NSEC is simpler and cheaper, NSEC3 hides the names. This is reported so the choice is a choice.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other dns dnssec checks
- The zone is signed with a deprecated algorithm
- Validating resolvers refuse to resolve the domain
- Signatures were read but not cryptographically verified
- The registry's DS record does not match any key in the zone
- The zone is signed but the registry has no DS record
- A DNSSEC key is shorter than the recommended size
- NSEC3 is configured with extra hash iterations
- NSEC3 opt-out weakens proof for unsigned subdomains
- DNSSEC could not be checked
- A DNSSEC signature has expired
- A DNSSEC signature expires within seven days
- The zone publishes keys but no signatures