RRSIG Lookup
An RRSIG record is a DNSSEC signature over a set of DNS records, valid only between its inception and expiration times. This lookup shows the signatures on a name and how long each one stays valid.
When to use this: A signed domain suddenly returns SERVFAIL, or you want to catch signatures before they expire. Command prefix rrsig:
About the RRSIG Lookup
Inspect DNSSEC signatures and their validity windows to catch signatures that are about to expire.
FAQ
- What happens when signatures expire?
- Validating resolvers stop trusting the data and return SERVFAIL until the zone is re-signed.
- Who re-signs the zone?
- Your DNS host or signing software, on a schedule. Expiring signatures usually mean that automation stopped.