An RRSIG record is a signature over one record set: all records with the same name, class and type. Every signed record set in the zone has at least one RRSIG next to it. Defined in RFC 4034.
example.com. 3600 IN RRSIG A 13 2 3600 20261103000000 20261020000000 36114 example.com. kd3s…
- Type covered
- The record type signed, here A.
- Algorithm
- 13 = ECDSA P-256. See algorithms.
- Labels
- Number of labels in the owner name. Used to detect wildcard answers.
- Original TTL
- The TTL at signing time.
- Expiration, inception
- The signature is valid only between these two times (UTC).
- Key tag
- The DNSKEY that made the signature.
- Signer's name
- The zone that signed.
- Signature
- The signature itself.
Signatures expire
Every signature has an end date. The signer must re-sign before then, usually every few days. If re-signing stops (a broken cron job, a stopped signer, a secondary that no longer gets transfers), validating resolvers return SERVFAIL when the signatures expire. Clock errors on a validating resolver cause the same failure.
That is the most common way a working DNSSEC setup breaks by itself. Monitor the expiration date:
dig +dnssec example.com A | grep RRSIG
See troubleshooting for the other causes.