RFC 9824: Compact Denial of Existence in DNSSEC
In plain English — editorial summary, not part of the RFC
This document describes a technique to generate a signed DNS response on demand for a nonexistent name by claiming that the name exists but doesn't have any data for the queried record type. Such responses require only one minimally covering NSEC or NSEC3 record, allow online signing servers to minimize signing operations and response sizes, and prevent zone content disclosure. This document updates RFCs 4034 and 4035.
Document record
- Document ID
- RFC9824
- Published
- September 2025
- Authors
- S. Huque; C. Elmerot; O. Gudmundsson
- Status
- PROPOSED STANDARD
- Stream
- IETF
- Area
- ops
- Pages
- 14
- Also known as
- —
Topics
Related documents
Ranked automatically by shared keywords, IETF area and stream — not by editorial selection.
- RFC 9276Guidance for NSEC3 Parameter SettingsCurrent
August 2022
- RFC 9904DNSSEC Cryptographic Algorithm Recommendation Update ProcessCurrent
November 2025
- RFC 9905Deprecating the Use of SHA-1 in DNSSEC Signature AlgorithmsCurrent
November 2025
- RFC 9906Deprecate Usage of ECC-GOST within DNSSECCurrent
November 2025
- RFC 9726Operational Considerations for Use of DNS in Internet of Things (IoT) DevicesCurrent
March 2025
- RFC 9364DNS Security Extensions (DNSSEC)Current
February 2023
- RFC 9077NSEC and NSEC3: TTLs and Aggressive UseCurrent
July 2021
- RFC 8976Message Digest for DNS ZonesCurrent
February 2021
Also filed under
About this page
The document record above — title, authors, date, status, stream, area, relationships, DOI and errata — is imported verbatim from the public RFC Editor index. The “in plain English” section is editorial: written by The metasystema editorial team, not part of the RFC. Where the two differ, the RFC text governs.
Last checked against the RFC Editor index on . RFCs are never revised after publication; changes are issued as new documents.
Data sources · Editorial policy · Report a correction · What is an RFC?