RRSIG Resource Record Signature Common

What it's for

An RRSIG (Resource Record Signature) record holds the actual cryptographic signature covering a specific set of records in a DNSSEC-signed zone. Where DNSKEY is the key and DS links trust to the parent, RRSIG is the record that does the real per-answer work: every signed recordset (all the A records for a name, all the MX records, etc.) gets its own RRSIG, and a validating resolver checks that signature against the zone's DNSKEY to confirm the data is authentic and unmodified.

Unlike most DNS records, RRSIGs are time-bound — they include explicit expiration and inception timestamps, which is a meaningfully different behavior from the rest of DNS.

Format & syntax

example.com.    3600    IN    RRSIG    A 8 2 3600 20260901000000 20260801000000 12345 example.com. Base64Signature...

• Type Covered — which record type this signature applies to (e.g. A)
• Algorithm — matching the signing algorithm used
• Labels — the number of labels in the original name, used in validating wildcard-expanded answers
• Original TTL — the TTL of the covered recordset as it was signed
• Signature Expiration / Inception — timestamps (not durations) defining the validity window of this specific signature
• Key Tag — identifies which DNSKEY was used to generate this signature
• Signer's Name — the zone that generated the signature
• Signature — the base64-encoded cryptographic signature itself

How it's used in practice

• Per-answer authenticity verification — every time a validating resolver gets a signed answer, it also retrieves the matching RRSIG and checks the signature against the zone's DNSKEY before trusting the data, on every single query for a signed zone.
• Automatic re-signing — because RRSIGs expire (unlike normal records), a DNSSEC-signed zone needs to be periodically re-signed before existing signatures run out. Managed DNS providers automate this; self-hosted DNSSEC setups need their own re-signing pipeline (often cron-driven, using tools like dnssec-signzone).
• Debugging DNSSEC validation failures — checking an RRSIG's expiration timestamp is one of the first things to look at when a DNSSEC-signed domain suddenly starts failing validation, since an expired signature is a common and very specific failure mode distinct from key or DS mismatches.

Common mistakes & gotchas

• Signatures expiring due to a stalled re-signing process — this is the single most DNSSEC-specific outage pattern: a zone's automation for re-signing breaks (a cron job silently fails, a key management service has an outage) and existing RRSIGs quietly expire, causing hard validation failures for anyone using a validating resolver — even though nothing about the actual record data changed.
• Clock skew — because RRSIG validity is based on absolute timestamps, a server with a significantly wrong system clock (either the signer or, more subtly, a validating resolver) can cause legitimate signatures to appear expired or not-yet-valid.
• Assuming RRSIG failures mean the record data is wrong — an expired or invalid RRSIG doesn't necessarily mean the underlying A/MX/TXT data is incorrect — it usually means the signing pipeline has a problem, which is a completely separate thing to debug from the record content itself.
• Overlooking RRSIG when manually inspecting DNS with basic tools — many everyday DNS lookup tools don't show RRSIG records by default (you typically need dig +dnssec or a similar explicit flag), so DNSSEC issues can be invisible unless you specifically go looking for them.

Comparison & FAQ

Why does my DNSSEC-signed domain suddenly fail validation with no record changes?

Check whether the RRSIG signatures have expired — since signatures are time-bound and need periodic re-signing, a stalled or broken re-signing process is a common cause of validation failures that have nothing to do with the actual record content changing.

Do normal (non-DNSSEC-aware) DNS tools show RRSIG records?

Not by default — most everyday lookup tools only show the "plain" answer. You typically need to explicitly request DNSSEC records (e.g. dig +dnssec) to see RRSIG, DNSKEY, and related records.

How often does a zone need to be re-signed?

It depends on the configured signature validity window, but it needs to happen well before existing RRSIGs expire — managed DNS providers automate this on a schedule; self-managed DNSSEC setups need their own reliable re-signing process.

Can an RRSIG be valid but the DNSKEY it references be wrong?

Not really in a way that validates successfully — the whole point of the signature is that it can only be verified against the correct matching key; if the key doesn't match, validation fails outright rather than partially succeeding.