Verify a signed record set
01DNSSEC authenticates the origin and integrity of DNS RRsets, not a server’s transport connection.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 3.1 ↗
RFC 4033 · § 3.1EXAMPLE
3 / 3
03
A changed covered record fails verification.
A changed covered record fails verification.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
An RRSIG covers an RRset and is verified using an appropriate DNSKEY.
- An RRSIG covers an RRset and is verified using an appropriate DNSKEY.
- Authenticity does not provide confidentiality or stop denial of service.
The drawing is a simplified worked example. Follow the linked RFC and its updates for implementation requirements.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy