Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is TSIG?
Short answer
TSIG (Transaction Signature) is the mechanism that signs the messages between two DNS parties sharing the same shared secret (e.g. two servers, or a client and a server) (RFC 8945). It is used in operations such as zone transfer and dynamic update to verify that the message comes from the authorized party and was not altered on the way; TKEY, in turn, is the record type used for establishing these keys between the parties (RFC 2930). Its difference from DNSSEC is that it protects not the zone data but a single transaction between the two parties that share the key. In TR7 GTM, TSIG and TKEY are present as record types in the Record Type list. In TR7 GTM, zone transfer access is restricted by IP address: the servers that will be permitted to receive the zone are added to the domain's Slave Server IPs list; on the Express side, NOTIFY is accepted only from the servers in the profile's Master Addresses list.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| GTM → GTM Services → service name → Records → Add | Record Type list: TSIG, TKEY | Appears as a record type |
| GTM → GTM Services → service name → Domains → Add / Edit | Slave Server IPs | Giving the zone transfer permission with an address list |
| GTM → Express Profiles (DNS Integration) | Master Addresses | The master servers whose NOTIFY is accepted and from which the zone is pulled |
Comparison
| TSIG | DNSSEC | |
|---|---|---|
| What it protects | A single transaction between the two parties that share the key (zone transfer, update) | The zone data itself |
| Key | The same shared secret on both sides | Private / public key pair |
| Verifier | The other party of the transaction | Any validating resolver that receives the response |
Common Misconceptions
- "TSIG validates the responses for all clients." TSIG works only between the two parties that know the shared secret; any resolver being able to validate the response is the job of DNSSEC (What is DNSSEC?).
- "The TSIG key is a public key." TSIG uses a shared secret that is the same on both sides.
- "Zone transfer is protected only by TSIG." Zone transfer access is also restricted with an address list; in TR7 GTM, this list is the Slave Server IPs field.
How it is done in the documentation
Related questions
