DNSSEC Signature Timestamp Validator

Build a utility that validates DNSSEC signature timestamps to ensure they are within their valid time window.

Requirements

Create a Python module that processes DNSSEC RRSIG records and checks if signatures are currently valid based on their inception and expiration times.

Your solution should:

1. Parse RRSIG records from DNS zone file format strings
2. Extract the signature inception and expiration timestamps
3. Determine if the signature is currently valid (current time is between inception and expiration)
4. Return validation results including time-based status

Input

Zone file format strings containing RRSIG records. Example format:

example.com. 300 IN RRSIG A 7 2 300 20240101000000 20230101000000 12345 example.com. c2lnbmF0dXJl

Output

For each RRSIG record, provide:

• Whether the signature is currently valid (boolean)
• Days until expiration (if valid) or days since expiration (if expired)
• Status message indicating the validation state

Implementation

@generates

API

def validate_rrsig_timestamp(zone_string: str) -> dict:
    """
    Validate RRSIG record timestamps from zone format.

    Args:
        zone_string: DNS zone file format string containing RRSIG record

    Returns:
        Dictionary with keys:
        - 'valid': bool indicating if signature is currently valid
        - 'days_remaining': float with days until expiration (negative if expired)
        - 'status': str with human-readable status message
    """
    pass

Test Cases

• Parsing an RRSIG record with expiration in the future returns valid=True @test
• Parsing an RRSIG record with expiration in the past returns valid=False @test
• Parsing an RRSIG record not yet valid (before inception) returns valid=False @test
• The function correctly calculates days_remaining for a valid signature @test

Dependencies { .dependencies }

dnslib { .dependency }

Provides DNS record parsing and DNSSEC support.

@satisfied-by