Skip to content
NewCybercrime Report 2026 · Eight Chapters · A Post Is Not An Incident → Explore The ChaptersCybercrime Report 2026 → Explore
Request A Demo
Glossary

GSS-TSIG

GSS-TSIG is a method for signing DNS messages with keys that come from Kerberos through the GSS-API. It is a TSIG algorithm defined in RFC 3645 and is used to authenticate dynamic DNS updates from Kerberos-integrated clients, such as those in Active Directory environments.

Published
Reading Time
1 min read
Dark glass sealed envelope with a key tag with red neon lines, cover art for: GSS-TSIG
Product track
External Attack Surface Management

What Is GSS-TSIG?

TSIG is a way to prove that a DNS message comes from an approved client or server. RFC 8945 describes it as transaction-level authentication using shared secrets and one-way hashing, and says it can authenticate dynamic updates to a DNS zone. GSS-TSIG, defined in RFC 3645, is a TSIG algorithm that gets its keys from the Generic Security Service API (GSS-API) instead of a secret typed into both sides by hand.

Where Is It Used?

In practice GSS-TSIG is how Kerberos-authenticated clients update DNS records. Red Hat describes it as what lets clients make Kerberos-authenticated dynamic DNS changes, for example during Active Directory or IdM enrollment. On a BIND server the tkey-gssapi-keytab setting names the Kerberos keytab file used for GSS-TSIG updates.

Why Does It Matter for Security?

ISC advisories in 2026 have touched this feature more than once. CVE-2026-94300 (October) is a memory corruption bug that may lead to remote code execution. CVE-2026-3039 (May) is a memory exhaustion bug in GSS-API TKEY negotiation. Our BIND 9 fixed versions and exposure check lists the patched releases.

How Do You Check Whether a Server Uses It?

  • Print the effective configuration with named-checkconf -p -x and search for tkey-gssapi-keytab and tkey-gssapi-credential.
  • Ask which Kerberos-integrated systems send dynamic updates to the server, such as Active Directory or FreeIPA.
  • If the feature is not needed, Red Hat’s advice is to remove the directives. That stops Kerberos-authenticated dynamic DNS updates, so test first.

Also Called

  • Generic Security Service TSIG

Frequently Asked Questions

What does GSS-TSIG stand for?

It stands for Generic Security Service Algorithm for Secret Key Transaction Authentication for DNS, the title of RFC 3645. It is an algorithm for TSIG built on the GSS-API.

What is the difference between TSIG and GSS-TSIG?

RFC 8945 describes TSIG as authentication using shared secrets and one-way hashing. GSS-TSIG, from RFC 3645, uses the GSS-API to obtain the key, which is how Kerberos fits in.

Is GSS-TSIG on by default in BIND?

Red Hat says BIND in standard Red Hat Enterprise Linux deployments does not enable GSS-TSIG by default. It is switched on with directives such as tkey-gssapi-keytab.

Sources

  1. RFC 3645: Generic Security Service Algorithm for Secret Key Transaction Authentication for DNS (GSS-TSIG), IETF1
  2. RFC 8945: Secret Key Transaction Authentication for DNS (TSIG), IETF2
  3. BIND 9 reference manual, ISC3
  4. CVE-2026-94300, Red Hat4
  5. CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation, ISC5
Related · ArticleBIND 9 CVE-2026-94300: Fixed Versions and How to Check Your Exposure

ISC fixed a BIND 9 vulnerability in GSS-TSIG that can corrupt memory and may allow code execution. Fixed versions, who is exposed and a…

Open →In plain words · Glossary termActive Directory

Active Directory is a directory service for managing identities in Windows domain networks, as NIST defines it.

Open →Related · VulnerabilityISC BIND 9 GSS-TSIG memory corruption (CVE-2026-94300)

CVE-2026-94300 is a memory corruption flaw in the GSS-TSIG handling of the BIND 9 name server.

Open →
ShareLinkedInX
Brandefense logo

Stay Ahead of Digital Threats.

Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.

Open The Full Demo Form →