rsasha256

RSASHA256 is a DNSSEC signature algorithm that combines RSA public-key cryptography with the SHA-256 cryptographic hash function to sign DNS data. It is used to authenticate zone information and DNS responses in DNSSEC-enabled domains. In this scheme, a DNSKEY resource record holds the public RSA key for a zone, and RRSIG records provide digital signatures generated with RSA and SHA-256, allowing resolvers to verify data integrity and authenticity.

The algorithm is defined by the DNSSEC standards maintained by the IETF, and it is widely supported by major DNS server implementations and validators. It is commonly implemented in software such as BIND, Unbound, Knot DNS, and various operating system DNS servers. RSASHA256 is typically preferred over RSASHA1 due to the stronger hash function, while remaining interoperable with many existing DNSSEC deployments that rely on RSA-based signatures.

Security and performance considerations are central to its use. RSA keys used with RSASHA256 should employ adequate length (commonly 2048 bits or larger) and diligent private-key protection, as compromise of the signer undermines zone integrity. RSA-based signing incurs higher computational and bandwidth costs compared to newer algorithms, such as elliptic-curve DNSSEC algorithms, which can influence key rollover and signature generation in large zones.

In deployment, RSASHA256 coexists with other DNSSEC algorithms, allowing algorithm agility during key rollover and signer upgrades. While widely supported, some operators consider migrating to ECC-based algorithms or Ed25519 for improved performance and smaller signatures.