RRSIG
type 46RFC 4034RRSIG (Resource Record Signature, type 46, RFC 4034) is the cryptographic signature over a DNS RRset. Every RRset in a DNSSEC-signed zone has a corresponding RRSIG record signed by the zone's ZSK (or KSK for the DNSKEY RRset). Validating resolvers verify the RRSIG against the appropriate DNSKEY to confirm the RRset has not been tampered with. RRSIG records have a validity window (Signature Inception and Signature Expiration timestamps).
Details
RRSIG records are the actual signatures that DNSSEC resolvers verify.
One RRSIG per RRset: Every distinct RRset (A records, MX records, AAAA records, etc.) at every owner name gets its own RRSIG. The RRSIG covers all records in the RRset together.
Signature algorithm: The same algorithm value as the signing DNSKEY. A zone with ECDSAP256SHA256 ZSK will have ECDSAP256SHA256 RRSIG records.
Signature validity window: Signature Inception: timestamp when the signature became valid. Signature Expiration: timestamp when the signature expires. Resolvers reject signatures outside this window. Zone operators must re-sign before expiration (typically every 2-4 weeks). Many operators use automated signing (BIND, PowerDNS, Knot DNS) to handle this.
Key tag: Links the RRSIG to the specific DNSKEY used for signing. Resolver uses this to select the right key for verification.
Original TTL: The TTL the RRset had at signing time. Resolvers use this to detect TTL extension attacks (where an attacker serves the RRset with a longer TTL from cache).
Do bit (DNSSEC OK): Clients request DNSSEC records by setting the DO bit in the EDNS0 OPT record of the query. Without DO bit, resolvers do not return RRSIG, DNSKEY, or NSEC/NSEC3 records. Validating resolvers always set the DO bit when querying authoritative servers.
Wire format fields
| Field | Description |
|---|---|
| Type Covered | The DNS type of the RRset being signed (e.g., 1=A, 15=MX, 28=AAAA). |
| Algorithm | Signing algorithm number matching the DNSKEY used (e.g., 13=ECDSAP256SHA256). |
| Labels | Number of labels in the original owner name. Used to detect wildcard expansion. |
| Original TTL | TTL of the signed RRset at signing time. Resolver uses this to detect TTL modification attacks. |
| Signature Expiration | Unix timestamp when the signature expires. Zone must be re-signed before this time. |
| Signature Inception | Unix timestamp when the signature became valid. |
| Key Tag | Key tag of the DNSKEY used to create this signature. |
| Signer's Name | Domain name of the zone that signed the RRset. |
| Signature | Cryptographic signature bytes over the signed RRset. |
Zone file example
; RRSIG covering the A record for www.example.com www.example.com. IN RRSIG A 13 3 300 ( 20260201000000 ; Signature Expiration 20260101000000 ; Signature Inception 12345 ; Key Tag (ZSK) example.com. ; Signer mdsswUyr3DPW132mOi8V9xESWE8jTo0d... ; Signature ) ; Retrieve with: dig A www.example.com +dnssec ; Validate with: dig A www.example.com +dnssec +sigchase (older BIND) ; : delv www.example.com A (BIND 9.10+, proper validation)