NAME

nsec — generate NSEC records for a zone

SYNOPSIS

DESCRIPTION

nsec writes DNSSEC NSEC records for a zone to standard output.

The records are generated for the zone described in zonefile, which must be in the format described by RFC 1035.

An NSEC record lists the record types available at a particular name, and the next valid name in the zone. It is used to fill in the gaps between the valid records in a zone and is returned alongside its signature in NXDOMAIN responses to prove the absence of the requested record.

OPTIONS

None.

EXAMPLES

Generate NSEC records for the example.com zone:

$ nsec example.com.zone
example.com.    1200    IN      NSEC    ns1.example.com. A NS SOA RRSIG NSEC DNSKEY
ns1.example.com.        1200    IN      NSEC    example.com. A RRSIG NSEC

SEE ALSO

dnskey(1), ds(1), rrsig(1), tlsa(1)