DNSViz complaining about NSEC3, but use NSEC

[WilliamDEdwards]

Hi,

Question from a DNSSEC noob. Not necessarily PowerDNS-related.

DNSViz is complaining about NSEC3:

NSEC3 proving non-existence of grunlift.de/DS: An iterations count of 0 must be used in NSEC3 records to alleviate computational burdens. See RFC 9276, Sec. 3.1.
NSEC3 proving non-existence of grunlift.de/DS: An iterations count of 0 must be used in NSEC3 records to alleviate computational burdens. See RFC 9276, Sec. 3.1.

... but I don't use NSEC3. I know this because pdnsutil show-zone says:

Zone has NSEC semantics

... which is only output when NSEC is used:

pdns/pdns/pdnsutil.cc

Line 2214 in 7322531

cout<<"Zone has NSEC semantics"<<endl;

pdns/pdns/pdnsutil.cc

Line 2163 in 7322531

cout<<"Zone has NSEC semantics"<<endl;

I only see this issue for .de domains.

Am I misunderstanding this message?

[Habbie]

It means that .de is not using the recommended parameters, and indeed;

dig nsec3param de.

; <<>> DiG 9.18.28-1~deb12u2-Debian <<>> nsec3param de.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2744
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;de.				IN	NSEC3PARAM

;; ANSWER SECTION:
de.			0	IN	NSEC3PARAM 1 0 15 CA12B74ADB90591A

;; Query time: 8 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
;; WHEN: Fri Oct 04 19:30:48 CEST 2024
;; MSG SIZE  rcvd: 56

they are using 15 iterations and a salt.