%% You should probably cite rfc7129 instead of this I-D. @techreport{gieben-auth-denial-of-existence-dns-01, number = {draft-gieben-auth-denial-of-existence-dns-01}, type = {Internet-Draft}, institution = {Internet Engineering Task Force}, publisher = {Internet Engineering Task Force}, note = {Work in Progress}, url = {https://datatracker.ietf.org/doc/draft-gieben-auth-denial-of-existence-dns/01/}, author = {R. (Miek) Gieben and Matthijs Mekking}, title = {{Authenticated Denial of Existence in the DNS}}, pagetotal = 23, year = 2012, month = nov, day = 23, abstract = {Authenticated denial of existence allows a resolver to validate that a certain domain name does not exist. It is also used to signal that a domain name exists, but does not have the specific RR type you were asking for. When returning a negative DNSSEC response, a name server usually includes up to two NSEC records. With NSEC3 this amount is three. This document provides extra documentation and context on the mechanisms behind NSEC and NSEC3}, }