RRSIG lifetime check

The zone is DNSSEC signed.

DNSSEC.

Randomly selected parent DNS server.

Every 5 minutes.

None.

None.

Purpose

Compare the lifetime of a RRSIG record with the SOA Expire timer.

To mitigate the risk of DNSSEC signature failure if the slave loses contact with its master for an extended period of time, the current best practice is to have a signature lifetime that is 3 to 4 times the duration of the SOA expiration timer. This way the zone will expire before the signature lifetime of the majority of records expires and causes DNSSEC validation failures.

This recommendation is issued in RFC 6781 DNSSEC Operational Practices, Version 2, in chapter 4.4.1.

Event severities and messages

RRSIG lifetime is between the recommended 3 and 4 times the SOA expiration timer.

RRSIG lifetime should be at least 3 times the SOA expiration timer.
See the purpose above.

Different SOA expiration timers on nameservers. Test is inconclusive.
This is very unusual but makes the task of calculating the delta value impossible.

Solutions, tips & tricks