TLSA record validation check
Prerequisites:
None.
Package:
Resource Records.
Executed on:
All nameserver IP addresses.
Check interval:
Every 5 minutes.
Impact on Availability:
None.
Impact on Integrity:
High.
Purpose
The check validates that the TLSA record remains unaltered to its configured values/values.
The TLS authentication record is used to link the X.509 digital TLS certificate fingerprint with a domain name. For this to work and for the TLSA record to be trusted, the zone must be signed by DNSSEC.
Event severities and messages
INFO
Records mach.
No detected changes to the TLSA record/records.
DNSSEC signature validates correctly.*
DNSSEC signature for the TLSA record set has passed validation.
ERROR
The record {Resource Record}exist in the domain but not as record type TLSA.
No TLSA record found.
The record {Resource Record} does not exist..
The query received a NXDOMAIN response.
Unrecognised records.
Lists records that should have been in the query response but weren’t.
Missing records.
Lists records that should have been included in the query response but weren’t.
{DNS IP} responded with RCODE for the record {Resource Record}.
Please see the Generic DNS response code page for further information.
DNSSEC validation failure.*
DNSSEC signature for this resource record has failed validation.
UNKNOWN
{DNS Name/IP} responded with RCODE for the record {Resource Record}.
Please see the Generic DNS response code page for further information.
* Require DNSSEC.