DNSKEY e RRSIG

DNSKEY and RRSIG

DNSKEY records publish public keys for a zone. RRSIG records carry signatures over RRsets. A validating resolver obtains the relevant key, checks the signature, and verifies that the signed data is still within its validity period.

Follow the chain: trust anchor → DS in the parent → DNSKEY in the child → RRSIG for the RRset. If any link fails, do not treat the answer as secure. The private signing key must remain protected; publishing a DNSKEY does not publish that secret key.

Check your understanding

Choose the best answer. This quiz runs locally and sends no DNS queries to real domains.

Quiz#dns.m7.l2.e1

What does an RRSIG sign?

उत्तर विकल्प

An RRsetThe entire IP packetThe registrar password

जांचेंसंकेत