An authoritative DNS server uses NSEC3PARAM RRs to determine which NSEC3 records it includes in its negative responses. An NSEC3PARAM RR contains the parameters that an authoritative server needs to calculate hashed owner names. As stated in RFC 5155, the presence of an NSEC3PARAM RR at a zone apex indicates that the specified parameters may be used by authoritative servers to choose an appropriate set of NSEC3 RRs for negative responses.
The NSEC3PARAM resource record is desribed in RFC 5155.
The NSEC3PARAM record is generated automatically upon the signing of the corresponding zone.
The name part of a DNS NSEC3PARAM object reference has the following components:
- The name of the record.
- The name of the view.
Example: record:nsec3param/ZG5zLmJpsaG9zdA:us.example.com/default.external
References to record:nsec3param are object references.
The object does not support the following operations:
The object cannot be managed on Cloud Platform members.
These fields are actual members of the object; thus, they can be requested by using _return_fields, if the fields are readable.
The basic version of the object contains the field(s): name, view.
The hash algorithm that was used.
Type
String.
Search
The field is available for search via
Notes
The algorithm cannot be updated.
algorithm cannot be written.
Structure containing all cloud API related information for this object.
Type
A/An Cloud Information struct.
Search
The field is not available for search.
Notes
The cloud_info cannot be updated.
cloud_info cannot be written.
The creation time of the record.
Type
Timestamp.
Search
The field is not available for search.
Notes
The creation_time cannot be updated.
creation_time cannot be written.
Creator of the record.
Type
String.
Search
The field is available for search via
Notes
The creator cannot be updated.
creator cannot be written.
Name for an NSEC3PARAM record in punycode format.
Type
String.
Values with leading or trailing white space are not valid for this field.
Search
The field is not available for search.
Notes
The dns_name cannot be updated.
dns_name cannot be written.
The set of 8 one-bit flags, of which only one flag, the Opt-Out flag, is defined by RFC 5155. The Opt-Out flag indicates whether the NSEC3 record covers unsigned delegations.
Type
Unsigned integer.
Search
The field is available for search via
Notes
The flags cannot be updated.
flags cannot be written.
The number of times the hash function was performed.
Type
Unsigned integer.
Search
The field is available for search via
Notes
The iterations cannot be updated.
iterations cannot be written.
The time of the last DNS query in Epoch seconds format.
Type
Timestamp.
Search
The field is not available for search.
Notes
The last_queried cannot be updated.
last_queried cannot be written.
The name of the NSEC3PARAM record in FQDN format. It has to be the same as the zone, where the record resides.
Type
String.
Search
The field is available for search via
Notes
The name is part of the base object.
The name cannot be updated.
name cannot be written.
A series of case-insensitive hexadecimal digits. It is appended to the original owner name as protection against pre-calculated dictionary attacks. A new salt value is generated when the ZSK rolls over, for which the user can control the period. For a random salt value, the selected length is between one and 15 octets.
Type
String.
Search
The field is not available for search.
Notes
The salt cannot be updated.
salt cannot be written.
The Time To Live (TTL) value for the record. A 32-bit unsigned integer that represents the duration, in seconds, for which the record is valid (cached). Zero indicates that the record should not be cached.
Type
Unsigned integer.
Search
The field is not available for search.
Notes
ttl is associated with the field use_ttl (see use flag).
The ttl cannot be updated.
ttl cannot be written.
Use flag for: ttl
Type
Bool.
Search
The field is not available for search.
Notes
The use_ttl cannot be updated.
use_ttl cannot be written.
The name of the DNS View in which the record resides. Example: “external”.
Type
String.
Values with leading or trailing white space are not valid for this field.
Search
The field is available for search via
Notes
The view is part of the base object.
The view cannot be updated.
view cannot be written.
The name of the zone in which the record resides. Example: “zone.com”. If a view is not specified when searching by zone, the default view is used.
Type
String.
Values with leading or trailing white space are not valid for this field.
Search
The field is available for search via
Notes
The zone cannot be updated.
zone cannot be written.
| Field | Type | Req | R/O | Base | Search |
|---|---|---|---|---|---|
| algorithm | String | N | Y | N | = |
| cloud_info | struct | N | Y | N | N/A |
| creation_time | Timestamp | N | Y | N | N/A |
| creator | String | N | Y | N | = |
| dns_name | String | N | Y | N | N/A |
| flags | Unsigned int | N | Y | N | < = > |
| iterations | Unsigned int | N | Y | N | < = > |
| last_queried | Timestamp | N | Y | N | N/A |
| name | String | N | Y | Y | : = ~ |
| salt | String | N | Y | N | N/A |
| ttl | Unsigned int | N | Y | N | N/A |
| use_ttl | Bool | N | Y | N | N/A |
| view | String | N | Y | Y | = |
| zone | String | N | Y | N | = |
record:nsec3 : DNS NSEC3 record object.
