Skip to content

NSEC3 are generated even for empty non-terminals that will be deleted after sign

Scenario:

  • In zone: a.b.c.example.com A 1.2.3.4, but no records for b.c.example.com or c.example.com -- those are empty non-terminals.
  • Zone signed with NSEC3.
  • Removed the A record from a.b.c.example.com, but not removed it's RRSIG.
  • After reload/restart NSEC3 records were generated for all three 'empty' names: c.example.com, b.c.example.com and a.b.c.example.com, although these names themselves are deleted after the signing.