dnsext-6----Page:10
1  2  3  4  5  6  7  8  9  10  11 

Further work
Non-existence proof:
2 NSEC3’s to prove closest encloser
1 shows closest encloser
1 shows non-existence of closer encloser
One label longer than the closest encloser
1 NSEC3 to prove absence of wildcards
The asterisk label plus the closest encloser.
The validator algorithm is subtle, please read the draft.
PPT Version