Authenticated Denial of Existence in the DNS

Authenticated denial of existence allows a resolver to validate that acertain domain name does not exist. It is also used to signal that adomain name exists but does not have the specific resource record (RR)type you were asking for. When returning a negative DNS SecurityExtensions (DNSSEC) response, a name server usually includes up to twoNSEC records. With NSEC version 3 (NSEC3), this amount is three. Thisdocument provides additional background commentary and some contextfor the NSEC and NSEC3 mechanisms used by DNSSEC to provideauthenticated denial-of-existence responses.