Zero-Knowledge DNS
Zero-knowledge DNS (ZK-DNS) refers to the application of zero-knowledge proof (ZKP) cryptography to domain name systems, enabling a party to prove the validity of a DNS record or domain ownership without revealing the underlying data. In the context of [[dnssec|DNSSEC]], ZK-based approaches can prove a name does not exist (denial of existence) without exposing the full list of signed names, solving the zone enumeration privacy problem that plagues traditional DNSSEC NSEC records. In the Web3 context, zero-knowledge proofs are explored for private ownership transfer of [[blockchain-domain|blockchain domains]] and confidential [[decentralized-dns|decentralized DNS]] lookups.
Example
A DNSSEC-signed zone uses a ZK-based NSEC replacement so that a resolver can verify that 'secret.example.com' does not exist without the nameserver revealing any other zone contents, preventing zone-walking attacks.