---
title: "Selecting a TSIG Key Format"
canonical: "https://docs.infoblox.com/space/BloxOneThreatDefense/35402519/Selecting%20a%20TSIG%20Key%20Format"
format: markdown
---
In 2017, security problems were discovered in two nameservers that were following [[RFC2845]](https://datatracker.ietf.org/doc/draft-dupont-dnsop-rfc2845bis/) and [[RFC4635]](https://datatracker.ietf.org/doc/rfc4635/) (that is, TSIG and HMAC-SHA extension) specifications strictly. The implementations were fixed, and to avoid similar problems in the future, the two specification documents were updated and merged; the result is the revised specification for TSIG.

The second area where the secret key–based MACs specified in this document can be used is to authenticate DNS-update requests and transaction responses. This approach would be a lightweight alternative to the protocol described in [[RFC3007]](https://datatracker.ietf.org/doc/rfc3007/).

> ⚠️ **Note**
> ⚠️ 
> ⚠️ Use of TSIG presumes that the resolver and server have already agreed about the algorithm and key they will use.