RRSIG

RU: RRSIG

RRSIG (Resource Record Signature): a DNSSEC record that holds the digital signature for an RRset, created with the zone's private signing key — the ZSK for regular data RRsets, the KSK for the DNSKEY RRset itself (RFC 4034). A validating resolver fetches the corresponding DNSKEY, verifies the signature, and rejects the answer if it does not match. RRSIG records carry a validity window (inception–expiration), so clock skew or stale caches can cause spurious validation failures.