GSS-TSIG is a method for signing DNS messages with keys that come from Kerberos through the GSS-API. It is a TSIG algorithm defined in RFC 3645 and is used to authenticate dynamic DNS updates from Kerberos-integrated clients, such as those in Active Directory environments.
- Also Called1other nameGeneric Security Service TSIG
- Related Terms2linked entriesActive Directory · Remote code execution (RCE)
What Is GSS-TSIG?
TSIG is a way to prove that a DNS message comes from an approved client or server. RFC 8945 describes it as transaction-level authentication using shared secrets and one-way hashing, and says it can authenticate dynamic updates to a DNS zone. GSS-TSIG, defined in RFC 3645, is a TSIG algorithm that gets its keys from the Generic Security Service API (GSS-API) instead of a secret typed into both sides by hand.
Where Is It Used?
In practice GSS-TSIG is how Kerberos-authenticated clients update DNS records. Red Hat describes it as what lets clients make Kerberos-authenticated dynamic DNS changes, for example during Active Directory or IdM enrollment. On a BIND server the tkey-gssapi-keytab setting names the Kerberos keytab file used for GSS-TSIG updates.
Why Does It Matter for Security?
ISC advisories in 2026 have touched this feature more than once. CVE-2026-94300 (October) is a memory corruption bug that may lead to remote code execution. CVE-2026-3039 (May) is a memory exhaustion bug in GSS-API TKEY negotiation. Our BIND 9 fixed versions and exposure check lists the patched releases.
How Do You Check Whether a Server Uses It?
- Print the effective configuration with
named-checkconf -p -xand search fortkey-gssapi-keytabandtkey-gssapi-credential. - Ask which Kerberos-integrated systems send dynamic updates to the server, such as Active Directory or FreeIPA.
- If the feature is not needed, Red Hat’s advice is to remove the directives. That stops Kerberos-authenticated dynamic DNS updates, so test first.
Also Called.
- NameGeneric Security Service TSIG
Questions.
-
What does GSS-TSIG stand for?
It stands for Generic Security Service Algorithm for Secret Key Transaction Authentication for DNS, the title of RFC 3645. It is an algorithm for TSIG built on the GSS-API.
-
What is the difference between TSIG and GSS-TSIG?
RFC 8945 describes TSIG as authentication using shared secrets and one-way hashing. GSS-TSIG, from RFC 3645, uses the GSS-API to obtain the key, which is how Kerberos fits in.
-
Is GSS-TSIG on by default in BIND?
Red Hat says BIND in standard Red Hat Enterprise Linux deployments does not enable GSS-TSIG by default. It is switched on with directives such as tkey-gssapi-keytab.
Sources
- 1 RFC 3645: Generic Security Service Algorithm for Secret Key Transaction Authentication for DNS (GSS-TSIG), IETF
- 2 RFC 8945: Secret Key Transaction Authentication for DNS (TSIG), IETF
- 3 BIND 9 reference manual, ISC
- 4 CVE-2026-94300, Red Hat
- 5 CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation, ISC
In Our Research
- 1 BIND 9 CVE-2026-94300: Fixed Versions and How to Check Your Exposure October 2026
- 2 Active Directory Glossary term
- 3 Kerberoasting Glossary term