According to Wikipedia:

DNSSEC introduces the ability for a hostile party to enumerate all the names in a zone by following the NSEC chain. NSEC RRs assert which names do not exist in a zone by linking from existing name to existing name along a canonical ordering of all the names within a zone. Thus, an attacker can query these NSEC RRs in sequence to obtain all the names in a zone. Although this is not an attack on the DNS itself, it could allow an attacker to map network hosts or other resources by enumerating the contents of a zone.

Most of the TLDs have adopted DNSSEC. Does the problem described above still exists? How can that be checked (e.g. Linux command)?


1 Answer 1


First, I will point out that private information should not be posted in the public domain name system. However, for the obscure case this is actually needed DNSSEC now supports NSEC3 for zones, which prevents this kind of attack (Although is more expensive on the DNS query from my understanding of how NSEC3 works compared to plain NSEC).

Edit: Didn't see the date on this question, hope my answer helps someone.

Edit2: Do note that as @kasperd points out below, this setup is still vulnerable to an offline brute force attack. Read the comments below for more information.

  • There is nothing wrong with posting a late answer to an old question without one (or where you can add something to existing answers). In fact, that is encouraged. So no need to worry about the date on the question.
    – Anders
    Commented Jun 8, 2016 at 22:47
  • 1
    NSEC3 only provides a partial solution though. It still permits enumeration of all the NSEC3 records after which an offline brute force attack can be mounted against those records to recover the original names. (Don't worry about the date on the question. Open questions with no answers are kept around such that they can be answered eventually. So answering this question is entirely within the spirit of the site.)
    – kasperd
    Commented Jun 8, 2016 at 22:48
  • @kasperd That is true, although there really isn't a way to stop brute force attacks, as they can be mounted against live non-DNSSEC servers with some effort as well.
    – ConnorJC
    Commented Jun 8, 2016 at 22:51
  • 1
    @ConnorJC Online attacks can be rate-limited. Had NSEC3 been designed slightly different, it could have prevented offline attacks. But I agree that anything put in DNS records should be assumed to be publicly available.
    – kasperd
    Commented Jun 8, 2016 at 22:58
  • @kasperd How could NSEC3 have been designed to prevent an offline attack, as the data must be verified essentially 'offline'?
    – ConnorJC
    Commented Jun 8, 2016 at 22:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .