Skip to content

Add changelog entry for NSEC3 support and update ENT-only availability for NSEC3 #22996

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Jun 11, 2025
Merged

Add changelog entry for NSEC3 support and update ENT-only availability for NSEC3 #22996

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
7082bb0
Add ENT-only availability for NSEC3
hannes-cf Jun 11, 2025
15dca28
Add changelog entry for NSEC3 support
hannes-cf Jun 11, 2025
439ae49
Merge pull request #1 from hannes-cf/patch-4-1
hannes-cf Jun 11, 2025
6d5670b
Fix typo
hannes-cf Jun 11, 2025
3095621
Update title
hannes-cf Jun 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions src/content/changelog/dns/2025-06-11-nsec3-support.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
---
title: NSEC3 support for DNSSEC
description: Cloudflare DNSSEC supports NSEC3 for proof of non-existence.
date: 2025-06-11T12:00:00Z
---

Enterprise customers can now select NSEC3 as method for proof of non-existence on their zones.

What's new:

- **NSEC3 support for live-signed zones** – For both primary and secondary zones that are configured to be live-signed (also known as "on-the-fly signing"), NSEC3 can now be selected as proof of non-existence.

- **NSEC3 support for pre-signed zones** – Secondary zones that are transferred to Cloudflare in a [pre-signed setup](/dns/zone-setups/zone-transfers/cloudflare-as-secondary/dnssec-for-secondary/#set-up-pre-signed-dnssec) now also support NSEC3 as proof of non-existence.

For more information and how to enable NSEC3, refer to the [NSEC3 documentation](/dns/dnssec/enable-nsec3/).
6 changes: 5 additions & 1 deletion src/content/docs/dns/dnssec/enable-nsec3.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,4 +51,8 @@ If the name `www` exists but the type TXT does not, the example below would trig
dig +dnssec www.example.com TXT
```

[^1]: A method where an attacker exploits NSEC negative answers to obtain all names in a given zone. This is possible when such negative answers provide information on the previous and next names in a chain.
## Availability

NSEC3 is only available for zones on the Enterprise plan.

[^1]: A method where an attacker exploits NSEC negative answers to obtain all names in a given zone. This is possible when such negative answers provide information on the previous and next names in a chain.
Loading