NSEC3 compliance check
Prerequisites:
The zone is DNSSEC signed and NSEC3 is used.
Package:
DNSSEC.
Executed on:
Randomly selected authoritative server.
Check interval:
Every 5 minutes.
Impact on Availability:
None.
Impact on Integrity:
None.
Purpose
Check NSEC3 settings for compliance to RFC 9276
In August 2022, the IETF published the RFC 9276 Guidance for NSEC3 Parameter Settings. NSEC3 is used to prove non-existence by signing the space between domain name pairs. Unlike its counterpart NSEC, NSEC3 avoids the direct disclosure of these domain name pairs by using hashed values to avoid “zone walking” to find out the zone contents.
Academic studies have shown that there is no real security benefit to adding a number of hash iterations and large salt values. Instead, it adds a computational burden to both the signing engine and the validating resolver. The RFC9276 explicitly states that the parameter for iterations MUST be zero and the salt values SHOULD be empty.
The check will issue warning or error messages if it finds incompatibilities with RFC 9276 when looking up the NSEC3 record for the zones.
Event severities and messages
INFO
RFC 9276 compliant.
N/A, NSEC3 not in use.
WARNING
The salt value for an NSEC3 record should be empty.
Values were found in the Salt field.
ERROR
An iteration count of 0 must be used in NSEC3 to alleviate computational burdens. See RFC 9276, section 3.1.
The parameter for number of iterations is bigger than 0.
Solutions, tips & tricks
Some DNS software won’t allow you to set a zero iteration count or an empty salt field. As this is a fairly new “recommendation”, we have decided not to let this check affect the Integrity or Availability metric until we’re sure that software vendors have caught up with the latest RFCs.