Current settings
0 extra iterations and no salt, as RFC 9276 recommends.
Free NSEC3PARAM lookup
Read a signed zone's NSEC3PARAM record: its hash algorithm, iterations and salt.
- Free, with no signup
- Runs in your browser
What your result means
Older settings
Extra iterations or a salt add work for resolvers without making the zone safer.
No record
The zone uses NSEC or is not signed.
Questions about the NSEC3PARAM lookup
What does NSEC3PARAM set?
The hash algorithm, the number of extra hash rounds and the salt that the zone's NSEC3 records use.
What do iterations do?
Each iteration hashes a name once more. RFC 9276 found that they add cost for resolvers and little protection, and recommends 0.
Is NSEC3 needed for email?
No. It only changes how a signed zone proves that names do not exist.
Found a problem? We will check the rest.
Book a deliverability audit and we will look at every domain and mailbox you send from.