ldns(3)

💅 ldns — denial of existence, but make it make sense

okay bestie, so this is a page from the ldns library functions manual (that's the ldns(3) corner of the world 🌸), and today's main characters are ldns_dnssec_verify_denial and ldns_dnssec_verify_denial_nsec3. Yes, the title is a whole vibe: verify denial of existence. Sit with that for a sec. 🫶

---

✨ NAME ✨

ldns_dnssec_verify_denial, ldns_dnssec_verify_denial_nsec3 — verify denial of existence

like, proving that something doesn't exist. the audacity. the drama. obsessed. 💖

---

🌈 SYNOPSIS 🌈

#include <stdint.h>
#include <stdbool.h>

#include <ldns/ldns.h>

ldns_status ldns_dnssec_verify_denial(ldns_rr *rr, ldns_rr_list *nsecs,
ldns_rr_list *rrsigs);

ldns_status ldns_dnssec_verify_denial_nsec3(ldns_rr *rr, ldns_rr_list
*nsecs, ldns_rr_list *rrsigs, ldns_pkt_rcode packet_rcode, ldns_rr_type
packet_qtype, bool packet_nodata);

copy those includes exactly bestie, don't get cute with them 🎀

---

👑 DESCRIPTION 👑

💀 ldns_dnssec_verify_denial()

denial is not just a river in egypt, bestie. 😭 that's literally what the page says and honestly? iconic. this function checks whether a bunch of NSEC RRs actually succeed in denying that the queried RR exists.

here's the tea, argument by argument:

• rr — the (query) RR you're checking the denial of existence for 👀
• nsecs — the list of NSEC RRs that are supposed to deny the existence of that RR
• rrsigs — the RRSIG RR covering the NSEC RRs 🔐

and what do you get back? LDNS_STATUS_OK if the NSEC RRs do deny the existence. if they don't, you get an error code that contains the reason why not. so it's not just "nope" — it's "nope, and here's exactly why." we love a function that explains itself. 💅

🧚 ldns_dnssec_verify_denial_nsec3()

same denial-of-existence energy, but with NSEC3 records. because NSEC3 is a bit more complicated than normal denial (she's high maintenance, and honestly? valid), you gotta pass in some extra context arguments so she has everything she needs. 🦋

the full cast:

• rr — the (query) RR to check the denial of existence for
• nsecs — the list of NSEC3 RRs that are supposed to deny the existence of the RR
• rrsigs — the RRSIG rr covering the NSEC RRs
• packet_rcode — the RCODE value of the packet that provided the NSEC3 RRs 📦
• packet_qtype — the original query RR type
• packet_nodata — true if the providing packet had an empty ANSWER section (a whole empty-answer moment, we've all been there 🙈)

return value? same deal as her sister: LDNS_STATUS_OK if the NSEC3 RRs deny the existence, otherwise an error code holding the reason they don't. no cap. 🔥

---

🫶 AUTHOR 🫶

the ldns team at NLnet Labs. legends, honestly. 👑

---

😭 REPORTING BUGS 😭

found something cursed? please report bugs to dns-team@nlnetlabs.nl or on GitHub at https://github.com/NLnetLabs/ldns/issues — they want to know, fr fr. 🐛

---

🎀 COPYRIGHT 🎀

Copyright (c) 2004 - 2006 NLnet Labs.

Licensed under the BSD License. and listen: there is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. read that again. no warranty bestie, none, not even the implied ones. 💀

---

🌸 SEE ALSO 🌸

• ldns_dnssec_trust_tree
• ldns_dnssec_data_chain

and perldoc Net::DNS, RFC1034, RFC1035, RFC4033, RFC4034 and RFC4035. yes that's a lot of RFCs, go read them, i'll wait. 📚✨

---

🙈 REMARKS 🙈

heads up: this manpage was automatically generated from the ldns source code. so if the prose feels a little robotic... that's because it was born that way. 🧚

---

okay and finally, the sign-off moment: this whole thing is dated 30 May 2006 and it belongs to the ldns(3) manual. so if you ever need to cite it, you know the date and you know the section. periodt. 💖✨🌈