NSEC Walkability

What It Does

Queries DNSKEY and NSEC3PARAM. Parses NSEC3 algorithm, flags (including the opt-out bit), iteration count, and salt. When the zone uses legacy NSEC (no NSEC3PARAM but DNSSEC-signed), demonstrates the leak by walking the NSEC chain and returning a sample of enumerated names — abstract risk becomes concrete exposure. Returns a risk grade of `walkable` (legacy NSEC; full enumeration possible), `partial` (NSEC3 with weak parameters per RFC 9276 — opt-out enabled, missing salt, or high iteration count), or `mitigated` (NSEC3 within RFC 9276 bounds). Surfaces a top-line `rfc9276_compliant` boolean and a paste-ready `recommended_nsec3param` value (`1 0 0 -`) per the RFC 9276 recommendations.

Why It's Useful

NSEC walking lets attackers enumerate every name in a DNSSEC-signed zone — staging servers, internal subdomains, the entire attack surface zone operators thought was private. Most tools tell you the zone is "walkable" abstractly; we demonstrate it by returning a sample of enumerated names. RFC 9276 (Aug 2022) gave concrete guidance — algorithm 1, no salt, 0 iterations, opt-out off — and the response tells you in one boolean whether you're compliant, plus the exact NSEC3PARAM string to publish to fix it.

Use Cases

Parameters

Response Fields

Code Examples

curl "https://api.edgedns.dev/v1/dns/nsec-walkability" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d "domain=example.com"

const response = await fetch(
  'https://api.edgedns.dev/v1/dns/nsec-walkability?domain=example.com',
  {
    headers: {
      'Authorization': 'Bearer YOUR_API_KEY'
    }
  }
);

const data = await response.json();
console.log(data);

import requests

response = requests.get(
    'https://api.edgedns.dev/v1/dns/nsec-walkability',
    headers={'Authorization': 'Bearer YOUR_API_KEY'},
    params={
    'domain': 'example.com'
    }
)

data = response.json()
print(data)

Related Endpoints

External References

Learn more about the standards and protocols behind this endpoint.