NSEC / NSEC3（DNSSEC 存在否定）
Embed This Widget
Add the script tag and a data attribute to embed this widget.
Embed via iframe for maximum compatibility.
<iframe src="https://tldfyi.com/iframe/glossary/nsec-nsec3/" width="420" height="400" frameborder="0" style="border:0;border-radius:10px;max-width:100%" loading="lazy"></iframe>Paste this URL in WordPress, Medium, or any oEmbed-compatible platform.
https://tldfyi.com/glossary/nsec-nsec3/Add a dynamic SVG badge to your README or docs.
[](https://tldfyi.com/glossary/nsec-nsec3/)Use the native HTML custom element.
NSEC（Next Secure）和NSEC3（RFC 5155）是用于证明查询的域名不存在的[[dnssec|DNSSEC]]记录类型，称为「认证存在否定」。NSEC按字母顺序链接记录，允许区域枚举（存在隐私隐患）。NSEC3在链接前对记录名称进行哈希处理，在防止轻易枚举的同时仍提供非存在的密码学证明。对于处理敏感数据的公共区域，强烈推荐使用NSEC3。
示例
When querying 'nonexistent.example.com' in a DNSSEC-signed zone, an NSEC3 record proves the name doesn't exist without revealing other names in the zone.