HTTPfy

RRSIG record

An RRSIG record is a DNSSEC signature over one RRset (all records of one type at one name). Validating resolvers check it with the zone's DNSKEY.

type code 46 RFC 4034RFC 4035

Live RRSIG records from real domains

Checked at via public DNS
cloudflare.comA + DNSSEC
cloudflare.com. 300 IN RRSIG A 13 2 300 20261112032410 20261110012410 34505 cloudflare.com. mHJFIdChZ5XJ+HbiTARCCyaXtE/8kB95 ZWAbEScITSwFbxOKJmWsKGPjQV8t6ELp SOgFq/waXfMpzawaTEnBwQ==
  ; signs the A RRset with ECDSAP256SHA256, key 34505 of cloudflare.com, valid 2026-11-10 01:24 UTC to 2026-11-12 03:24 UTC
isc.orgA + DNSSEC
isc.org. 300 IN RRSIG A 13 2 300 20261121065922 20261107061422 27566 isc.org. 7fj88Bs1W5qijtcIWtsdsKouTPheini/ LlWZspa/nxhoJtWcUYQ8SnxcofZA4Ig6 5Vt2Zqk7Zg56LkNbHZ8Zjg==
  ; signs the A RRset with ECDSAP256SHA256, key 27566 of isc.org, valid 2026-11-07 06:14 UTC to 2026-11-21 06:59 UTC
ietf.orgA + DNSSEC
ietf.org. 300 IN RRSIG A 13 2 300 20261112032413 20261110012413 34505 ietf.org. Hn6/GQ3hAb466xyJEH5AZGZdjMVgP8yu DzZrFsDYfj2nXStV+1Jqo7/FRHinIYzL YiTPcQ+LPFlBEgGHNSUNeg==
  ; signs the A RRset with ECDSAP256SHA256, key 34505 of ietf.org, valid 2026-11-10 01:24 UTC to 2026-11-12 03:24 UTC
DNSSEC Inspector for cloudflare.com →

What the RRSIG record does

Every RRset in a signed zone has at least one RRSIG next to it. Resolvers that set the DO ("DNSSEC OK") bit receive them alongside the answer. A signature is valid only between its inception and expiration times, so signed zones must be re-signed continuously. Online signers such as Cloudflare create signatures on the fly, valid for a couple of days, while offline-signed zones often use one to four weeks.

The labels field lets a resolver tell when an answer came from a wildcard: if the owner name has more labels than the signature says, the answer was expanded from *.

Zone-file syntax

example.com.  300  IN  RRSIG  A 13 2 300 20261112021451 20261110001451 34505 example.com. Avojfs8VswTh...
; type-covered alg labels orig-ttl expiration inception key-tag signer signature

Wire format: RDATA: type covered (16 bits), algorithm, labels, original TTL, expiration and inception (32-bit seconds since epoch), key tag, signer name, signature.

Fields

FieldMeaning
Type coveredThe RRset type this signature covers.
AlgorithmSame numbering as DNSKEY (13 = ECDSAP256SHA256).
LabelsLabel count of the original owner name, excluding root and a leading *.
Original TTLTTL as published, needed to rebuild the signed data.
Expiration / InceptionValidity window, written YYYYMMDDHHmmSS in UTC.
Key tag / SignerWhich DNSKEY (in which zone) made the signature.

Common mistakes

  • A signer that stopped re-signing (a cron job or HSM failed); the zone goes SERVFAIL when signatures expire.
  • Server clock skew, making fresh signatures look "not yet valid".
  • Querying for type RRSIG directly and expecting a useful answer. Many resolvers refuse it; ask for the real type with DNSSEC enabled instead.

Specification

  • RFC 4034: Resource Records for the DNS Security Extensions
  • RFC 4035: Protocol Modifications for the DNS Security Extensions

Related record types

  • DNSKEY: the public keys that sign a zone
  • DS: the DNSSEC link from parent to child zone
  • NSEC: authenticated denial of existence

All DNS record types