Two kinds of signatures can appear in updates. Request signatures, which are always required, cover the entire request and authenticate the DNS header, including opcode, counts, etc., as well as the data. Data signatures, on the other hand, appear only among the RRs to be added and are only required for mode A operation. These two types of signatures are described further below.