NSEC
The zone proves missing names by naming the next real name, which lets anyone list its names.
Free NSEC lookup for DNSSEC denial records
See the NSEC or NSEC3 records a signed zone uses to prove that a name or record does not exist.
- Free, with no signup
- Runs in your browser
What your result means
NSEC3
The zone proves missing names with hashed names, so it cannot be listed by walking it.
No proof
The zone is not signed with DNSSEC.
Questions about the NSEC lookup
What is the difference between NSEC and NSEC3?
Both prove that a name does not exist. NSEC names the next real name in the zone; NSEC3 uses hashes of names instead.
Can someone list my zone through NSEC?
Yes. By following each NSEC record to the next name, anyone can list every name in a zone that uses plain NSEC.
Why does the lookup ask for a name that does not exist?
A signed zone shows its proof only for a missing name, so the lookup asks for one and reads the proof.
Found a problem? We will check the rest.
Book a deliverability audit and we will look at every domain and mailbox you send from.