Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What are DNSKEY, RRSIG and NSEC records?
Short answer
DNSKEY, RRSIG and NSEC are the building-block records of DNSSEC (RFC 4034). DNSKEY publishes the public key of the zone; the resolver validates the signatures with this key. RRSIG is the digital signature of an RRset (all the records with the same name and type). NSEC and its enhanced form NSEC3 (RFC 5155) prove in signed form that a queried name or record type does not exist; in this way even the "does not exist" response cannot be forged. In TR7 GTM, when DNSSEC is turned on in a domain, these records are generated automatically during signing; the public key of the zone is seen in the DNS KEY line in the DNSSEC Info for window. These types are also present in the Record Type list.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| GTM → GTM Services → service name → Domains → Add / Edit | DNSSEC (Enabled) | Starting the generation of the DNSKEY, RRSIG and NSEC records |
| GTM → GTM Services → service name → Domains → DNSSEC lock | DNS KEY line (DNSSEC) | Seeing the public key of the zone |
| GTM → GTM Services → service name → Records → Add | Record Type list: DNSKEY, RRSIG, NSEC, NSEC3, NSEC3PARAM, CDNSKEY, CDS | DNSSEC record types |
| GTM → GTM Services → service name → Dashboard → Query Types | DNSKEY Queries and DS Queries panels | Monitoring the key and DS queries of validating resolvers |
Their Roles
| Record | What it carries | Question it answers |
|---|---|---|
| DNSKEY | Public key | With which key do I validate the signature? |
| RRSIG | Signature | Was this RRset altered on the way? |
| NSEC / NSEC3 | Proof of non-existence | Does this name or record type really not exist? |
| DS (in the parent zone) | Digest of the key | Can I trust this key? (What is a DS record; why is it submitted to the registrar in DNSSEC?) |
Common Misconceptions
- "RRSIG is a separate signature for each record row." The signature is produced jointly for the RRset, that is, for all the records with the same name and type.
- "NSEC3 is an encryption method." By hashing the names, NSEC3 makes it harder to easily list the zone contents; it does not encrypt the responses.
- "For DNSSEC, RRSIG records must be added manually." In a domain with DNSSEC on, the signatures are generated automatically as the records change.
How it is done in the documentation
