NSEC3 performance in DNSSEC

In a computing environment, a system for servicing a DNS resolution request from a client, the system comprising:

• one or more processors;
• and
• one or more computer-readable media devices, wherein the one or more computer-readable media devices comprise computer-executable instructions that when executed by at least one of the one or more processors cause at least one of the one or more processors to perform the following:
• receiving at a server, a request from a DNS client, the request identifying a domain name to be resolved for the client, and wherein the domain name comprises a domain name that is not able to be resolved by the server as the domain name does not correspond to a record for a domain name that can be resolved by the server;
• identifying a hash of the domain name as being part of a set of hashes, each of the hashes in the set of hashes being hashes of domain names that cannot be resolved by the server, and wherein the hash of the domain name identified at the server was computed using a first cryptographic technique, but wherein the hash can be computed by an external system using a second cryptographic technique and wherein the first cryptographic technique is able to compute the hash in substantially fewer or substantially less complex operations than the operations required to compute the hash using the second cryptographic technique;
• as a result of identifying a hash of the domain name at the server as being part of the set of hashes, returning a result indicating that the domain name cannot be resolved, including returning an indicator identifying the set of hashes;
• and
• as part of a verification process of the result indicating that the domain name cannot be resolved, causing the client to compute the hash of the domain name using the second cryptographic technique, after receiving the indicator identifying the set of hashes, such that the hash of the domain name was computed using the first cryptographic technique prior to causing the client to compute the hash of the domain name using the second cryptographic technique, to verify that the hash of the domain name is included in the set of hashes.

One or more computer-readable media devices, wherein the one or more computer-readable media devices comprise computer-executable instructions that when executed by at least one or more processors cause at least one of the one or more processors to perform the following:

• receiving at a server, a request from a DNS client, the request identifying a domain name to be resolved for the client, and wherein the domain name comprises a domain name that is not able to be resolved by the server as the domain name does not correspond to a record tor a domain name that can be resolved by the server;
• identifying a hash of the domain name as being part of a set of hashes, each of the hashes in the set of hashes being hashes of domain names that cannot be resolved by the server, and wherein the hash of the domain name identified at the server was computed using a first cryptographic technique, but wherein the hash can be computed by an external system using a second cryptographic technique and wherein the first cryptographic technique is able to compute the hash in substantially fewer or substantially less complex operations than the operations required to compute the hash using the second cryptographic technique;
• as a result of identifying a hash of the domain name at the server as bong part of the set of hashes, returning a result indicating that the domain name cannot be resolved, including returning an indicator identifying the set of hashes;
• and
• as part of a verification process of the result indicating that the domain name cannot be resolved, causing the client to compute the hash of the domain name using the second cryptographic technique, after receiving the indicator identifying the set of hashes, such that the hash of the domain name was computed using the first cryptographic technique prior to causing the client to compute the hash of the domain name using the second cryptographic technique, to verify that the hash of the domain name is included in the set of hashes.