OARC 47 (Vancouver, BC)

Dissecting NSEC and NSEC3 Deployment in the Wild

9 Nov 2026, 16:30

20m

Asia Pacific Hall (Morris J. Wosk Centre For Dialogue, SFU)

In-Person Standard Presentation Main Session OARC 47 Day 1

Speaker

Yixin Sun (University of Virginia)

Description

We present a large-scale measurement study of NSEC and NSEC3 behavior across 174 million domains in the .com, .net and .org zones, together with domains drawn from four major popularity rankings. Characterizing denial-of-existence implementations in the wild is challenging due to provider-specific deployments. To address this, we introduce new statistical metrics to distinguish heterogeneous Compact Denial of Existence (CDE) and White Lies deployments across DNS providers.

We further examine the interaction between authenticated denial-of-existence responses and wildcard synthesis. Our measurements suggest that wildcard behavior is non-negligible, potentially affecting approximately 19% of NSEC-enabled and 15% of NSEC3-enabled .com domains. We also analyze transitions between NODATA and NXDOMAIN responses across different levels of the DNS hierarchy. These transitions show where wildcard synthesis ceases to apply and can reveal limited information about zone structure, including the presence of closest-encloser boundaries.

Compared with the prior NSEC/3 presentation in DNS-OARC 44, our study:
- Expands the Measurement Scope: Evaluates current NSEC and NSEC3 deployments across three major gTLDs and multiple popularity lists.
- Characterizes In-the-wild Deployment: Develops new metrics to identify heterogeneous NSEC and NSEC3 variants and the name servers associated with these behavior.
- Deepens the Wildcard Analysis: Provides a detailed look at wildcard synthesis and its operational interactions with authenticated denial-of-existence responses.