Módulo 7 · Lição 2 de 425/54 no curso~14 min
Lições do módulo (2/4)
DNSKEY e RRSIG
DNSKEY and RRSIG
DNSKEY records publish public keys for a zone. RRSIG records carry signatures over RRsets. A validating resolver obtains the relevant key, checks the signature, and verifies that the signed data is still within its validity period.
Follow the chain: trust anchor → DS in the parent → DNSKEY in the child → RRSIG for the RRset. If any link fails, do not treat the answer as secure. The private signing key must remain protected; publishing a DNSKEY does not publish that secret key.
Check your understanding
Choose the best answer. This quiz runs locally and sends no DNS queries to real domains.
What does an RRSIG sign?