Skip to main content

RFC 9824 - Compact Denial of Existence in DNSSEC

  • Status: Proposed Standard
  • Published: September 2025
  • Stream: IETF
  • Pages: 14
  • Updates: RFC 4034, RFC 4035
  • Errata: No Errata

Abstract​

This document describes a technique to generate a signed DNS response on demand for a nonexistent name by claiming that the name exists but has no data for the queried record type. Such responses require only one minimally covering NSEC or NSEC3 record and help prevent zone content disclosure.