TSIGRecordValidator
class TSIGRecordValidator implements DnsRecordValidatorInterface (View source)
TSIG (Transaction SIGnature) record validator
Validates TSIG records according to:
- RFC 8945: Secret Key Transaction Authentication for DNS (TSIG) This RFC obsoletes RFC 2845 and RFC 4635.
TSIG is used for DNS transaction authentication using shared secrets and one-way hashing. Common uses include authenticating dynamic updates and zone transfers.
TSIG format:
Example: hmac-sha256. 1609459200 300 MTIzNDU2Nzg5MGFiY2RlZg== 12345 0 0
Where:
- algorithm-name: Domain name identifying the cryptographic algorithm (e.g. hmac-sha256.)
- timestamp: Seconds since 1-Jan-70 UTC when the message was signed
- fudge: Seconds of error permitted in timestamp (typically 300)
- mac: Base64 encoded cryptographic hash of the request using the shared secret
- original-id: Original DNS message ID (16-bit number)
- error: Extended RCODE covering TSIG processing (0-23)
- other-len: Length (in octets) of other data
- other-data: Optional additional data
Security considerations:
- Modern HMAC algorithms (SHA-256, SHA-384, SHA-512) are strongly recommended over MD5
- Secret keys should be changed periodically
- Accurate system clocks are required to prevent replay attacks
- TSIG authentication complements but doesn't replace DNSSEC validation
- RFC 8945 recommends using minimum 16 octets for truncated MACs
Methods
validate(string $content, string $name, mixed $prio, int|string|null $ttl, int $defaultTTL, mixed ...$args)
Validates TSIG record content
Details
__construct(ConfigurationManager $config)
No description
ValidationResult
validate(string $content, string $name, mixed $prio, int|string|null $ttl, int $defaultTTL, mixed ...$args)
Validates TSIG record content
Performs validation according to RFC 8945 and checks for security best practices.