[GH-ISSUE #706] Generate NSEC records on the fly #277

New issue

Open

opened 2026-03-07 23:14:42 +03:00 by kerem · 1 comment

kerem commented

2026-03-07 23:14:42 +03:00

Owner

Originally created by @bluejekyll on GitHub (Mar 5, 2019).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/706

Is your feature request related to a problem? Please describe.
Read this for background https://blog.cloudflare.com/dnssec-done-right/

The idea is to prevent zone walking, by generating NSEC records per request.

Describe the solution you'd like
On any query to an Authority, generate NSEC records (and the associated RRSIG) on demand. There should be a caching mechanism put in place, such that NSEC records do not become a massive load on the system. This will require DNSKEY private key material to be available on-line on the node used to generate the records.

Originally created by @bluejekyll on GitHub (Mar 5, 2019). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/706 **Is your feature request related to a problem? Please describe.** Read this for background https://blog.cloudflare.com/dnssec-done-right/ The idea is to prevent zone walking, by generating NSEC records per request. **Describe the solution you'd like** On any query to an Authority, generate NSEC records (and the associated RRSIG) on demand. There should be a caching mechanism put in place, such that NSEC records do not become a massive load on the system. This will require DNSKEY private key material to be available on-line on the node used to generate the records.

kerem added the

enhance

crate:server

feature:dnsssec

labels

2026-03-07 23:14:42 +03:00

kerem commented

2026-03-07 23:14:53 +03:00

Author

Owner

@bluejekyll commented on GitHub (Apr 5, 2019):

@darkspirit I’m considering just making the library only do online signing and generation of NSEC records. Thoughts?

That is, there won’t be an option for offline signing.

@bluejekyll commented on GitHub (Apr 5, 2019): @darkspirit I’m considering just making the library only do online signing and generation of NSEC records. Thoughts? That is, there won’t be an option for offline signing.

kerem referenced this issue

2026-03-16 02:00:48 +03:00

[PR #277] [MERGED] Make DNSSEC optional in server. #1332