RRSIG record
An RRSIG record carries the digital signature DNSSEC attaches to a specific set of DNS records -- all the A records for a name, for instance -- so a validating resolver can confirm that set hasn't been altered or forged since the zone's owner signed it. It is defined, like the rest of the DNSSEC record types, in RFC 4034, and a resolver verifies it using the public key published in the zone's DNSKEY record, which it has in turn confirmed is genuine through a DS record at the parent zone. Each RRSIG carries an explicit validity window, and a signature that has expired without being re-signed causes every validating resolver to treat the covered records as unverifiable, taking the zone offline for DNSSEC-aware resolvers even though the underlying records themselves never changed -- a common cause of a signed domain breaking unexpectedly.
By AdminKit team, Netbase JSC · Updated