RRSIGRecordValidator

RRSIG (Resource Record Signature) record validator for DNSSEC

Validates RRSIG records according to:

• RFC 4034: Resource Records for the DNS Security Extensions
• RFC 4035: Protocol Modifications for the DNS Security Extensions
• RFC 6781: DNSSEC Operational Practices, Version 2

RRSIG records contain signatures for DNS record sets (RRsets) and are a critical component of DNSSEC. These signatures allow validators to authenticate DNS data.

Format: <signer's-name>

Example: A 8 2 86400 20230515130000 20230415130000 12345 example.com. AQPeAHj...

Where:

• covered-type: The type of RRset covered by this signature (e.g., A, AAAA, MX)
• algorithm: DNSSEC algorithm used for the signature
  • 1 = RSA/MD5 (deprecated)
  • 3 = DSA/SHA1 (insecure)
  • 5 = RSA/SHA-1 (insecure)
  • 7 = RSASHA1-NSEC3-SHA1
  • 8 = RSA/SHA-256 (recommended)
  • 10 = RSA/SHA-512
  • 13 = ECDSA P-256 with SHA-256
  • 14 = ECDSA P-384 with SHA-384
  • 15 = ED25519
  • 16 = ED448
• labels: Number of labels in the original name (excluding leftmost wildcard)
• orig-ttl: The TTL of the covered RRset as it appears in the authoritative zone
• sig-expiration: Signature expiration time (YYYYMMDDHHmmSS format)
• sig-inception: Signature inception time (YYYYMMDDHHmmSS format)
• key-tag: Key tag identifying the DNSKEY that validates this signature
• signer's-name: Domain name of the zone containing the RRset (must end with a dot)
• signature: Cryptographic signature data (base64 encoded)

Security considerations:

• RRSIG validity period should be limited (typically 30 days)
• Regular key rollovers are recommended (ZSK: 1-3 months, KSK: 1-2 years)
• RSA/SHA-256 (algorithm 8) or newer algorithms are recommended for security
• Signatures should be renewed before expiration to avoid validation failures
• TTL value of RRSIG record must match the TTL of the RRset it covers