RRSIG Record
ActiveThe RRSIG (Resource Record Signature) record contains the DNSSEC cryptographic signature for a set of DNS records.
In one line
The RRSIG (Resource Record Signature) record contains the DNSSEC cryptographic signature for a set of DNS records. Every signed record set in a DNSSEC zone has a corresponding RRSIG. Validating resolvers verify the RRSIG against the zone's DNSKEY to confirm the records haven't been tampered with. RRSIG records have an expiration date and must be periodically re-signed.
Description
RRSIG records are DNSSEC's mechanism for data integrity. Each RRSIG covers one RRset (all records of the same type at the same name). The signature is created by the Zone Signing Key (ZSK) for most records, and by the Key Signing Key (KSK) for DNSKEY records. RRSIG records include: covered type, algorithm, labels count, original TTL, expiration, inception, key tag, signer name, and the base64-encoded signature.
Examples
dig example.com A +dnssecdig example.com ANY +dnssec +multiline