NSEC3DIG(1)

📦
version 5.1.4 · 8 versions
, in alpine 3.24, debian trixie, epel 10, epel 9, fedora 43, fedora 44, ubuntu stonking

✨ NSEC3DIG — the manual page, but make it cute ✨

okay so bestie, welcome to the nsec3dig era — it lives in the PowerDNS Authoritative Server family and it's literally here to show you and validate your NSEC3 proofs. she's giving forensic girly. no cap. 💅

🎀 NAME 🎀

nsec3dig — she shows you NSEC3 proofs and validates them, and she does not gatekeep. 👑

🦋 SYNOPSIS 🦋

nsec3dig IPADDRESS PORT QNAME QTYPE [recurse]

that's it. five slots, four of them mandatory, one lil optional bestie in brackets. 🌸

💖 DESCRIPTION 💖

okay so here's the vibe: nsec3dig fires off a query for QNAME and QTYPE at the nameserver sitting at IPADDRESS, on port PORT. then — and this is the main character moment — it prints out whether the NSEC3 proofs are correct, and why they're correct. receipts. always receipts. 🧾✨

and if you pass the recurse option? that sets the Recursion Desired (RD) bit in the query. she said "yes, please go find it for me bestie". 🫶

fr fr, recurse is the whole entire fifth argument. lowercase, as written. don't get cute with it.

🌈 EXAMPLE 🌈

here's exactly what it looks like in the wild, copy it, love it, run it:

nsec3dig 8.8.8.8 53 doesnotexist.isoc.nl TXT recurse

so: nameserver at 8.8.8.8, port 53, asking about doesnotexist.isoc.nl, query type TXT, and yeah we're setting that RD bit with recurse. iconic behaviour honestly. 🔥

👑 AUTHOR 👑

PowerDNS.COM BV — the masterminds, the parents, the originators. 💜

PowerDNS.COM BV — all the rights, all the vibes, legally locked in. 🎀

and that's the whole page, bestie!! 🦋💖 this lil legend came to you from the PowerDNS Authoritative Server crew, dated Aug 05, 2026, and she ate. periodt. 💅✨🌸

📦 where this page comes from