What is a DNS signature (RRSIG)?

You've probably heard of DNSSEC protecting your domain, and RRSIG is the cryptographic stamp that makes it work. Think of it as an official seal on each DNS record saying "this data hasn't been tampered with."

An RRSIG (Resource Record Signature) is a digital signature that proves a DNS record is authentic. When you enable DNSSEC, your DNS records get signed with a private key. That signature is stored as an RRSIG record. When a mail server requests your SPF or DKIM record, it gets both the record and its signature. The server then checks the signature against your public key to verify nothing's been altered in transit.

For email senders, RRSIG matters because it's part of the authentication stack that proves your sending domain is legitimate. Mail filters use it to verify your SPF and DKIM records haven't been forged by an attacker. Without DNSSEC and RRSIG, a sophisticated attacker could potentially intercept DNS lookups and return fake authentication records to trick mail servers into accepting spoofed messages.

Here's the thing though: DNSSEC isn't universally adopted yet, and many mail receivers don't require it. If you're just starting out with email authentication, focus on getting DKIM and SPF working first. DNSSEC and RRSIG are the security upgrade you add later when you're ready for that extra layer. Next step: verify your SPF and DKIM are set up correctly with our free tools, then consider DNSSEC once those are solid.