What is RRSIG?

An RRSIG (resource record signature) is a DNSSEC record holding a digital signature over one set of DNS records, valid only between two set times.

DNSSEC signs record sets, not individual records: all the records with the same name, class and type, such as every A record for www.example.net, are covered by one RRSIG made with the zone's private key. An RRSIG's fields record what was signed and how:

• Type covered (e.g. A, MX, DS) and algorithm (13 for ECDSA P-256).
• Labels and original TTL, so the resolver can rebuild exactly what was signed, even for wildcard answers and after the TTL has counted down in a cache.
• Signature expiration and inception, as timestamps such as 20261029000000.
• Key tag and signer's name, pointing to the DNSKEY that verifies it.
• The signature itself.

A validating resolver checks the signature with the matching public key, which it trusts through the parent's DS record, and rejects the answer if the signature doesn't verify or the current time is outside the validity window.

Because signatures expire, a signed zone has to be re-signed regularly. Signatures that have expired, often after a signing job silently stopped, are a classic way for a signed domain to disappear overnight with SERVFAIL. A resolver whose clock is badly wrong fails in the same way. Missing signatures are another trap: a validator expects RRSIGs throughout a zone it knows is signed, and reports Extended DNS Error 10, "RRSIGs Missing", when they're absent. PowerDNS signs answers as it serves them, so its zones don't need a re-signing job. The PowerDNS on Debian lesson shows the RRSIGs on a signed delegation, and the "RRSIGs Missing" failure.