diff --git a/dns.go b/dns.go
index 0095aadb..a37fc244 100644
--- a/dns.go
+++ b/dns.go
@@ -133,7 +133,7 @@ func (h *RR_Header) Header() *RR_Header {
 	return h
 }
 
-func (h *RR_Header) copy() *RR_Header {
+func (h *RR_Header) Copy() *RR_Header {
 	r := new(RR_Header)
 	r.Name = h.Name
 	r.Rrtype = h.Rrtype
diff --git a/dnssec.go b/dnssec.go
index aea59a31..10c6ec92 100644
--- a/dnssec.go
+++ b/dnssec.go
@@ -637,7 +637,8 @@ func (p wireSlice) Swap(i, j int) { p[i], p[j] = p[j], p[i] }
 func rawSignatureData(rrset []RR, s *RR_RRSIG) (buf []byte) {
 	wires := make(wireSlice, len(rrset))
 	for i, r := range rrset {
-		h := r.Header().copy()
+		h := r.Header().Copy()
+		h.Ttl = s.OrigTtl
 		labels := SplitLabels(h.Name)
 		// 6.2. Canonical RR Form. (4) - wildcards
 		if len(labels) > int(s.Labels) {
@@ -661,6 +662,7 @@ func rawSignatureData(rrset []RR, s *RR_RRSIG) (buf []byte) {
 			defer func() { x.Target = p }()
 			x.Target = strings.ToLower(x.Target)
 		case *RR_SOA:
+			x.Hdr = *h	 // NO NO NO need to copy each RR
 			p := x.Ns
 			q := x.Mbox
 			defer func() { x.Ns = p }()
@@ -713,7 +715,6 @@ func rawSignatureData(rrset []RR, s *RR_RRSIG) (buf []byte) {
 		}
 		// 6.2. Canonical RR Form. (5) - origTTL
 		wire := make([]byte, r.Len()*2)
-		h.Ttl = s.OrigTtl
 		off, ok1 := packRR(r, wire, 0, nil, false)
 		if !ok1 {
 			return nil
diff --git a/types.go b/types.go
index e3e716ba..aaa88657 100644
--- a/types.go
+++ b/types.go
@@ -200,6 +200,10 @@ func (rr *RR_CNAME) Len() int {
 	return rr.Hdr.Len() + l
 }
 
+func (rr *RR_CNAME) Copy() *RR_CNAME {
+	return &RR_CNAME{Hdr: *rr.Hdr.Copy(), Target: rr.Target}
+}
+
 type RR_HINFO struct {
 	Hdr RR_Header
 	Cpu string