NSEC3 opt-out weakens proof for unsigned subdomains
What this check looks for
Your zone is configured so that it cannot prove an unsigned subdomain does not exist. Someone able to inject DNS answers could invent a subdomain of yours and a resolver could not tell.
Why it matters
Opt-out exists for registries with millions of mostly-unsigned delegations, where the saving is enormous. For an ordinary domain it gives up a real security property in exchange for a saving that does not matter at your zone's size.
When the check passes, your report says: “NSEC3 proves the absence of every name, signed or not”.
What it costs your score
When this check fails it removes 4 points from your DNSSEC score, before the status, confidence and repeat multipliers are applied. DNSSEC carries a weight of 4 in the overall score.
It shares the dnssec.nsec3 family ceiling of 9 points: however many findings that family produces, together they cannot remove more than that from DNSSEC. One underlying problem showing up in several places is still one problem.
- Severity
- low
- Default confidence
- confirmed
- Status when triggered
- warn
- Deduction
- 4 points
- Family cap
- dnssec.nsec3 · 9
- Category
- DNSSEC
- Module
- Dns dnssec
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Turn opt-out off, or use NSEC instead of NSEC3.
Opt-out gives up provable non-existence for a saving that only matters at registry scale.
Change the NSEC3 configuration at your DNS host to disable opt-out.
If your zone has few names and enumeration is not a concern, plain NSEC is simpler and cheaper still.
Re-sign the zone so the change takes effect.
How to confirm it worked
dig +dnssec nonexistent-name.‹domain› — check the NSEC3 flags field is 0 rather than 1
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
The NSEC3 records for ‹domain› have the opt-out flag set. RFC 5155 §6 explains the consequence: delegations without a DS record are not covered by the denial-of-existence proof, so their non-existence cannot be proved and a forged delegation cannot be detected. If this zone has no delegated subdomains at all, the practical exposure is small — but the setting is still buying you nothing.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other dns dnssec checks
- The zone is signed with a deprecated algorithm
- Validating resolvers refuse to resolve the domain
- Signatures were read but not cryptographically verified
- The registry's DS record does not match any key in the zone
- The zone is signed but the registry has no DS record
- A DNSSEC key is shorter than the recommended size
- The zone's record names can be enumerated
- NSEC3 is configured with extra hash iterations
- DNSSEC could not be checked
- A DNSSEC signature has expired
- A DNSSEC signature expires within seven days
- The zone publishes keys but no signatures