Compact Denial of Existence in DNSSEC

Metadata

Publisher: IETF
Doc Type: Standard
Pages: 14
Abstract: This document describes a technique to generate a signed DNS response on demand for a nonexistent name by claiming that the name exists but doesn't have any data for the queried record type. Such responses require only one minimally covering NSEC or NSEC3 record, allow online signing servers to minimize signing operations and response sizes, and prevent zone content disclosure. This document updates RFCs 4034 and 4035.
Publication Date: 2025-09-01
Status Note: Proposed Standard
DOI: 10.17487/RFC9824
Link: https://doi.org/10.17487/RFC9824
Author(s): Shumon Huque
Christian Elmerot
Ólafur Guðmundsson
Keyword(s): DNS, DNSSEC, Denial of Existence, Compact Denial of Existence, NXDOMAIN, NODATA, Empty Non-Terminal

Latest version of IETF RFC 9824

Document Versions — IETF RFC 9824

▶ IETF RFC 9824 (2025-09-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

IETF RFC 2119 [Active*]
IETF RFC 3225 [Active*]
IETF RFC 4034 [Active*]
IETF RFC 4035 [Active*]
IETF RFC 4470 [Active*]
IETF RFC 4648 [Active*]
RFC5155 — RFC5155 EXTERNAL
IETF RFC 6891 [Active*]
IETF RFC 6895 [Active*]
IETF RFC 8174 [Active*]
RFC8914 — RFC8914 EXTERNAL
RFC9364 — RFC9364 EXTERNAL

Bibliographic Reference(s)

IETF.draft-huque-dnsop-blacklies-ent-01 — I-D.huque-dnsop-blacklies-ent EXTERNAL
IETF.draft-ogud-fake-nxdomain-type-00 — I-D.ogud-fake-nxdomain-type EXTERNAL
IETF.draft-valsorda-dnsop-black-lies-00 — I-D.valsorda-dnsop-black-lies EXTERNAL
Nishida, K., "Water Torture: A Slow Drip DNS DDoS Attack on QTNet", <https://conference.apnic.net/data/39/dnswatertortureonqtnet_1425130417_1425507043.pptx>. EXTERNAL
RFC7129 — RFC7129 EXTERNAL
IETF RFC 8020 [Active*]
IETF RFC 8198 [Active*]
IETF RFC 8305 [Active*]
IETF RFC 9499 [Active*]

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC9824.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 9824, Compact Denial of Existence in DNSSEC. Available at https://doi.org/10.17487/RFC9824

Snippet:

IETF RFC 9824, Compact Denial of Existence in DNSSEC. Available at https://doi.org/10.17487/RFC9824

HTML (ISO 690 compliant)

Preview:

IETF RFC 9824, Compact Denial of Existence in DNSSEC. Available at https://doi.org/10.17487/RFC9824

Snippet:

<span class="citation"><cite>IETF RFC 9824</cite>, Compact Denial of Existence in DNSSEC. Available at <a href="https://doi.org/10.17487/RFC9824" target="_blank" rel="noopener">https://doi.org/10.17487/RFC9824</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 9824, Compact Denial of Existence in DNSSEC
doi: 10.17487/RFC9824
url: https://doi.org/10.17487/RFC9824

Snippet:

<li>
<cite id="bib-rfc9824">IETF RFC 9824</cite>, Compact Denial of Existence in DNSSEC
<span class="doi">10.17487/RFC9824</span>
</li>