TSIG

networkingsecurity

Stands for: Transaction Signature

A shared-key method for authenticating DNS transactions like zone transfers.

Transaction Signature (RFC 8945) uses a shared secret and an HMAC to authenticate DNS messages - most importantly zone transfers between primary and secondary servers - proving they were not forged or tampered with.

TSIG authenticates DNS transactions using a shared secret, most often to secure zone transfers and dynamic updates so a secondary accepts a zone only from the real primary and an update only from an authorized client.

It is symmetric, which is its strength and its limit: fast and simple, and requiring a secret at both ends that must be distributed and rotated. That makes it appropriate between servers under one administration and unsuitable at internet scale, which is where DNSSEC's asymmetric signatures do the different job of proving data authenticity to anyone rather than proving transaction authenticity to a peer. Confusing the two is common, and the distinction is that TSIG protects the conversation while DNSSEC protects the content.

Also known as: tsig

← All glossary entries