Transaction Signature (TSIG) Authentication

Transaction Signature (TSIG) allows our name servers to authenticate communication to your master name server(s). This requires that you register a TSIG key and then assign it to a master name server. A brief description for each component of a TSIG key is provided below.

Component	Description
TSIG Alias	A label that provides a brief description for a TSIG key. This label is solely used to identify a TSIG key when assigning it to a master name server.
Key Name	Identifies the key on the master name server and our Route name servers. This name must be unique.
Key Type	Identifies the cryptographic hash function used to generate the key value. Our TSIG implementation supports MD5, SHA-1, and SHA-2 (SHA-224, SHA-256, SHA-384, and SHA-512).
Key Value	Identifies a hash value through which our name servers will be authenticated to a master name server.

Key information:

• A TSIG key may be assigned to each master name server associated with a secondary zone group. Our name servers will use the selected key when communicating with those master name servers.
• If you plan on using TSIG authentication, it is recommended to assign a unique key for each master name server.
• TSIG key administration may be performed when modifying a secondary zone group.
• Assigning a TSIG key to a master name server will only authenticate communication generated for the zones associated with that secondary zone group. If other secondary zone groups also leverage the same master name server, then you will need to update their configuration as well.
• Changes made to a TSIG key are applied globally. All secondary zone groups that leverage that TSIG key will use the updated configuration when authenticating DNS communication.
• A TSIG key cannot be deleted if it is currently assigned to a master name server.

To add a TSIG key

1. Navigate to the Route (DNS) page.
2. Click on the secondary zone group that contains a master name server to which you would like to add or modify TSIG authentication.
3. Click Manage TSIG Keys.
4. In the TSIG Alias option, specify a brief, descriptive name for the TSIG key.
5. In the Key Name option, indicate a unique name by which the master and Route name servers will identify the key.
6. In the Key Type option, select the cryptographic hash function used to generate the key value.
7. In the Key Value option, paste the hash value generated for this key.
8. Click Add.
9. Click Done.
10. Find the desired master name server and assign it that TSIG key by selecting it from the –Select TSIG – option.
11. Click Submit Group to save your changes.

To modify a TSIG key

1. Navigate to the Route (DNS) page.
2. Click on the desired secondary zone group.
3. Click Manage TSIG Keys.
4. Click "Edit" next to the desired TSIG key.
5. Review the TSIG key and modify the alias, name, cryptographic hash function, and hash value as needed.
6. Click Done when finished.
7. Click Done to close TSIG management.
8. Click Submit Group to save your changes.

To delete a TSIG key

1. Navigate to the Route (DNS) page.
2. Click on the desired secondary zone group.
3. Click Manage TSIG Keys.
4. Click "Edit" next to the desired TSIG key.
5. Click the delete icon ().
6. Click Done to close TSIG management.
7. Click Submit Group to confirm the deletion of that TSIG key.