NSEC3HASH(1)

💅 NSEC3HASH 💅

ok so this is nsec3hash, bestie — it's part of BIND 9, and it does exactly one thing and does it slay: it makes NSEC3 hashes ✨

---

🌸 NAME 🌸

nsec3hash — generate NSEC3 hash 🎀

---

✨ SYNOPSIS ✨

nsec3hash {salt} {algorithm} {iterations} {domain}

nsec3hash -r {algorithm} {flags} {iterations} {salt} {domain}

like, two whole modes. pick your fighter 💅

---

🦋 DESCRIPTION 🦋

okay so nsec3hash generates an NSEC3 hash based on a set of NSEC3 parameters. that's the whole vibe. you can use it to check whether the NSEC3 records in a signed zone are actually valid — like a vibe check but for crypto, no cap 🔥

and here's the cute part: if this command is invoked as nsec3hash -r, it takes its arguments in order, matching the first four fields of an NSEC3 record followed by the domain name: algorithm, flags, iterations, salt, domain. so you can literally copy-paste a chunk of an NSEC3 or NSEC3PARAM record straight into your command line to confirm an NSEC3 hash is correct. it's giving convenience, it's giving main character energy 👑

---

🎀 ARGUMENTS 🎀

• salt — the salt you're feeding to the hash algorithm. yes it's literally called salt. iconic.
• algorithm — a number indicating the hash algorithm. currently the only supported hash algorithm for NSEC3 is SHA-1, which is indicated by the number 1; so 1 is literally the only useful value for this argument. like, the only one. periodt.
• flags — this exists purely for compatibility with the NSEC3 record presentation format, but it's ignored, because the flags do not affect the hash. it's just there. standing in the corner. being decorative 🫶
• iterations — the number of additional times the hash should be performed. so it's hash, then hash again, and again… you get it.
• domain — the domain name to be hashed. obviously 💖

---

🌈 SEE ALSO 🌈

• BIND 9 Administrator Reference Manual
• RFC 5155

go read them, iyk yk 📚

---

👑 AUTHOR 👑

Internet Systems Consortium 💜

---

🍓 COPYRIGHT 🍓

2026, Internet Systems Consortium

---

and that's the whole page, bestie!! this one's version 9.20.29, dated 2026-09-11, straight from the BIND 9 girlies at ISC — go hash something and slay 💅✨🎀