TSIG (Transaction Signature)
TSIG (Transaction Signature) is a mechanism, defined in RFC 8945, for authenticating a DNS message using a secret key shared between two servers, rather than trusting the message based on where it came from. Each signed message carries a keyed-hash (HMAC) computed over its contents plus a timestamp, so the receiving server can confirm both that the sender holds the shared secret and that the message hasn't been replayed or altered in transit. It is most commonly used to control zone transfers (AXFR) and dynamic DNS updates: instead of, or alongside, restricting those operations to an allow-list of IP addresses, a server can require a valid TSIG signature, which still works correctly even if the requesting server's IP address changes. Because the secret is shared out of band and never sent in the DNS message itself, TSIG is vulnerable only if that secret leaks, not to IP spoofing.
By AdminKit team, Netbase JSC · Updated