RRSIG record
An RRSIG record is a DNSSEC signature over all the records of one type at one name. Signed zones have one beside every record set, created automatically by the DNS host. Each signature has a start and end date; if a zone stops being re-signed, signatures expire and validating resolvers refuse the answers.
| Record type | RRSIG |
|---|---|
| Type number | 46 |
| Used for | DNSSEC |
| How common | Common |
| Defined in | RFC 4034 |
Format
<name> <ttl> IN RRSIG <type covered> <algorithm> <labels> <original ttl> <expiration> <inception> <key tag> <signer> <signature>
| Field | What it means | Accepted values |
|---|---|---|
| Type covered | Which record type this signs. | Such as A, MX, DNSKEY. |
| Algorithm, key tag, signer | Which key made the signature. | Matches a DNSKEY. |
| Labels, original TTL | Used to check wildcards and TTLs. | Numbers. |
| Expiration, inception | When the signature is valid. | YYYYMMDDHHmmSS in UTC. |
| Signature | The signature itself. | Base64. |
Check an RRSIG record
Type or paste a record in zone-file form (name, TTL, type, value) or just its value. Each part is explained as you type.
A valid RRSIG record.
| Part | What it means |
|---|---|
| Nameexample.com. | A full name: the final dot means nothing is added to it. |
| TTL300 | Resolvers may keep this answer for 5 minutes before asking again. Changes can take that long to reach everyone. |
| ClassIN | Internet. Every record you'll write uses IN. |
| TypeRRSIG | DNSSEC signature. |
| Type coveredA | This signature covers the A records at this name. |
| Algorithm13 | 13 is ECDSA P-256 with SHA-256. The recommended choice: small keys and signatures, supported everywhere. |
| Labels2 | The signed name has 2 labels. Fewer than the name shows means it was made by a wildcard. |
| Original TTL300 | The TTL the records had when signed: 5 minutes. |
| Expiration20261107000000 | Valid until 2026-11-07 00:00 UTC. |
| Inception20261024000000 | Valid from 2026-10-24 00:00 UTC. |
| Key tag34505 | Identifies which DNSKEY made the signature. |
| Signerexample.com. | The zone whose key signed this. |
| SignatureJm4yNw0Mz4Ec8Y4hXqqGOrZxW6KMyc6v6E2W5I4nZbNt0z3+V5f3ZpH0Uj9x1qYv3HnS0… | The signature itself, in base64. |
Examples
Signature on an A record
example.com. 300 IN RRSIG A 13 2 300 20261107000000 20261024000000 34505 example.com. Jm4yNw0Mz4Ec8Y4hXqqGOrZxW6KMyc6v6E2W5I4nZbNt0z3+V5f3ZpH0Uj9x1qYv3HnS0fW6dQ6gPZjV9Y2iKQ==
Valid for two weeks from 24 October 2026, signed by key 34505.
Look up RRSIG records
TTL
The same as the records it signs. How TTL works
Common mistakes
- Running your own signer and letting signatures expire, which takes the zone offline for validating resolvers.
At your DNS host
- Never added by hand at managed DNS hosts; they sign automatically.
Questions
Why don't I see RRSIG records in my DNS dashboard?
Because the host creates them on the fly or when publishing. You'll see them in lookups with DNSSEC enabled.
This page is also available as Markdown.
Lemon Domains keeps every domain you own in one place, with expiry reminders, change monitoring and DNS editing from your AI assistant. Get started free