What is an RRSIG record?

An RRSIG record holds the DNSSEC cryptographic signature that authenticates a specific set of DNS records in a signed zone. Each RRSIG signs one record type (such as A or MX) and proves the data has not been altered.

How do I use this tool?

Enter a domain name and the tool queries its RRSIG records server-side, then shows the signed type, the signature's validity dates, the key tag and the signing algorithm. No signup is needed and nothing you enter is stored.

Why do RRSIG records matter?

RRSIG records are what make DNSSEC verification possible, letting resolvers confirm that DNS answers are genuine and unmodified in transit. Without valid signatures, DNSSEC cannot protect a domain against spoofing or cache poisoning.

What do the fields in the result mean?

The main fields are the signature inception and expiration timestamps, the key tag identifying the DNSKEY used, and the algorithm number. If the expiration date has passed, the signature is stale and resolvers will treat the zone as bogus until it is re-signed.

Why does my domain show no RRSIG records?

RRSIG records only exist when a zone is DNSSEC-signed, so an empty result usually means DNSSEC is not enabled for that domain. Because each RRSIG covers one record type, signatures appear only alongside the record sets they sign.

RRSIG Record Look Up

Related tools

Domain name

What do you want to look up?

Blacklist Look Up

Looks up whether this domain's IP address (or the IP address you entered) appears on common email blacklists (DNSBL) — being listed can cause outgoing mail to be rejected or sent to spam.

Also look up blacklist status when I run this search

What this is

RRSIG records are the actual DNSSEC signatures — one for each record set in a signed zone. Each has an inception and expiration time and must be re-generated (re-signed) periodically.

How to read your result

Signatures should have expiration dates comfortably in the future. Anything expiring within days deserves attention: healthy automation renews signatures well ahead of expiry.

Common problems and how to fix them

Signatures expired

How it shows up: The domain hard-fails on validating resolvers while non-validating resolvers still work — mirroring a DS mismatch, but caused by time rather than keys.

How to fix it: Re-sign the zone immediately (with managed DNS this means contacting the provider — expired RRSIGs are their bug). Then find out why the re-signing automation stopped: it should never get within days of expiry.

Server clock skew makes valid signatures look invalid

How it shows up: Sporadic validation failures reported by some resolvers even though signatures look current.

How to fix it: Ensure the signing infrastructure and authoritative servers run NTP-synchronized clocks; inception times slightly in the future break validation for strict resolvers.

Frequently asked questions

What is an RRSIG record?: An RRSIG record holds the DNSSEC cryptographic signature that authenticates a specific set of DNS records in a signed zone. Each RRSIG signs one record type (such as A or MX) and proves the data has not been altered.
How do I use this tool?: Enter a domain name and the tool queries its RRSIG records server-side, then shows the signed type, the signature's validity dates, the key tag and the signing algorithm. No signup is needed and nothing you enter is stored.
Why do RRSIG records matter?: RRSIG records are what make DNSSEC verification possible, letting resolvers confirm that DNS answers are genuine and unmodified in transit. Without valid signatures, DNSSEC cannot protect a domain against spoofing or cache poisoning.
What do the fields in the result mean?: The main fields are the signature inception and expiration timestamps, the key tag identifying the DNSKEY used, and the algorithm number. If the expiration date has passed, the signature is stale and resolvers will treat the zone as bogus until it is re-signed.
Why does my domain show no RRSIG records?: RRSIG records only exist when a zone is DNSSEC-signed, so an empty result usually means DNSSEC is not enabled for that domain. Because each RRSIG covers one record type, signatures appear only alongside the record sets they sign.