# RRSIG record

An RRSIG record is a DNSSEC signature over all the records of one type at one name. Signed zones have one beside every record set, created automatically by the DNS host. Each signature has a start and end date; if a zone stops being re-signed, signatures expire and validating resolvers refuse the answers.

- Record type: RRSIG
- Type number: 46
- Used for: DNSSEC
- How common: Common
- Defined in: RFC 4034

## Format

```
<name> <ttl> IN RRSIG <type covered> <algorithm> <labels> <original ttl> <expiration> <inception> <key tag> <signer> <signature>
```

| Field | What it means | Accepted values |
| --- | --- | --- |
| Type covered | Which record type this signs. | Such as A, MX, DNSKEY. |
| Algorithm, key tag, signer | Which key made the signature. | Matches a DNSKEY. |
| Labels, original TTL | Used to check wildcards and TTLs. | Numbers. |
| Expiration, inception | When the signature is valid. | YYYYMMDDHHmmSS in UTC. |
| Signature | The signature itself. | Base64. |

## Examples

### Signature on an A record

```
example.com. 300 IN RRSIG A 13 2 300 20261107000000 20261024000000 34505 example.com. Jm4yNw0Mz4Ec8Y4hXqqGOrZxW6KMyc6v6E2W5I4nZbNt0z3+V5f3ZpH0Uj9x1qYv3HnS0fW6dQ6gPZjV9Y2iKQ==
```

Valid for two weeks from 24 October 2026, signed by key 34505.

## TTL

The same as the records it signs.

## Common mistakes

- Running your own signer and letting signatures expire, which takes the zone offline for validating resolvers.

## At your DNS host

- Never added by hand at managed DNS hosts; they sign automatically.

## Questions

### Why don't I see RRSIG records in my DNS dashboard?

Because the host creates them on the fly or when publishing. You'll see them in lookups with DNSSEC enabled.

## Related

- [DNSKEY record](https://lemon.domains/dns-records/dnskey.md)
- [DS record](https://lemon.domains/dns-records/ds.md)
- [NSEC record](https://lemon.domains/dns-records/nsec.md)
- [NSEC3 record](https://lemon.domains/dns-records/nsec3.md)

Interactive version with a record checker and live lookup: https://lemon.domains/dns-records/rrsig