Authenticated Denial of Existence in the DNS

Metadata

Publisher: IETF
Doc Type: Informational
Pages: 30
Abstract: Authenticated denial of existence allows a resolver to validate that a certain domain name does not exist. It is also used to signal that a domain name exists but does not have the specific resource record (RR) type you were asking for. When returning a negative DNS Security Extensions (DNSSEC) response, a name server usually includes up to two NSEC records. With NSEC version 3 (NSEC3), this amount is three. This document provides additional background commentary and some context for the NSEC and NSEC3 mechanisms used by DNSSEC to provide authenticated denial-of-existence responses.
Publication Date: 2014-02-01
Status Note: Informational
DOI: 10.17487/RFC7129
Link: https://doi.org/10.17487/RFC7129
Author(s): R. (Miek) Gieben
Matthijs Mekking
Keyword(s): Internet, DNSSEC, Denial of Existence, NSEC, NSEC3

Latest version of IETF RFC 7129

Document Versions — IETF RFC 7129

▶ IETF RFC 7129 (2014-02-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

IETF RFC 1034 [Active*]
IETF RFC 2065 [Superseded*]
IETF RFC 2308 [Active*]
IETF RFC 4033 [Active*]
IETF RFC 4034 [Active*]
IETF RFC 4035 [Active*]
IETF RFC 4592 [Active*]
IETF RFC 4648 [Active*]
IETF RFC 5155 [Active*]
IETF RFC 6672 [Active*]

Bibliographic Reference(s)

Laurie, B., "DNSSEC NSEC2 Owner and RDATA Format" , Work in Progress, October 2004. EXTERNAL
Arends, R., "DNSSEC Non-Repudiation Resource Record" , Work in Progress, June 2004. EXTERNAL
Josefsson, S., "Authenticating denial of existence in DNS with minimum disclosure", Work in Progress, November 2000. EXTERNAL
Kaminsky, D., "Phreebird: a DNSSEC proxy", January 2011, < http://dankaminsky.com/phreebird/ >. EXTERNAL
NLnet Labs, "Unbound: a validating, recursive, and caching DNS resolver", 2006, < http://unbound.net >. EXTERNAL
IETF RFC 2535 [Superseded*]
IETF RFC 3655 [Superseded*]
IETF RFC 3755 [Superseded*]
IETF RFC 4470 [Active*]
IETF RFC 4956 [Active*]

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC7129.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 7129, Authenticated Denial of Existence in the DNS. Available at https://doi.org/10.17487/RFC7129

Snippet:

IETF RFC 7129, Authenticated Denial of Existence in the DNS. Available at https://doi.org/10.17487/RFC7129

HTML (ISO 690 compliant)

Preview:

IETF RFC 7129, Authenticated Denial of Existence in the DNS. Available at https://doi.org/10.17487/RFC7129

Snippet:

<span class="citation"><cite>IETF RFC 7129</cite>, Authenticated Denial of Existence in the DNS. Available at <a href="https://doi.org/10.17487/RFC7129" target="_blank" rel="noopener">https://doi.org/10.17487/RFC7129</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 7129, Authenticated Denial of Existence in the DNS
doi: 10.17487/RFC7129
url: https://doi.org/10.17487/RFC7129

Snippet:

<li>
<cite id="bib-rfc7129">IETF RFC 7129</cite>, Authenticated Denial of Existence in the DNS
<span class="doi">10.17487/RFC7129</span>
</li>

Referenced By

IETF RFC 7719 [Superseded*]
IETF RFC 8198 [Active*]
IETF RFC 8499 [Superseded*]
IETF RFC 9499 [Active*]
IETF RFC 9824 [Active*]