# File lib/Dnsruby/resource/TSIG.rb, line 118
      def self.verify()
        # 3.2. TSIG processing on incoming messages
        #
        #   If an incoming message contains a TSIG record, it MUST be the last
        #   record in the additional section.  Multiple TSIG records are not
        #   allowed.  If a TSIG record is present in any other position, the
        #   packet is dropped and a response with RCODE 1 (FORMERR) MUST be
        #   returned.  Upon receipt of a message with a correctly placed TSIG RR,
        #   the TSIG RR is copied to a safe location, removed from the DNS
        #   Message, and decremented out of the DNS message header's ARCOUNT.  At
        #   this point the keyed message digest operation is performed.  If the
        #   algorithm name or key name is unknown to the recipient, or if the
        #   message digests do not match, the whole DNS message MUST be
        #   discarded.  If the message is a query, a response with RCODE 9
        #   (NOTAUTH) MUST be sent back to the originator with TSIG ERROR 17
        #   (BADKEY) or TSIG ERROR 16 (BADSIG).  If no key is available to sign
        #   this message it MUST be sent unsigned (MAC size == 0 and empty MAC).
        #   A message to the system operations log SHOULD be generated, to warn
        #   the operations staff of a possible security incident in progress.
        #   Care should be taken to ensure that logging of this type of event
        #   does not open the system to a denial of service attack.      
      end