diff --git a/Knot.files b/Knot.files
index e4df68333e2b8e7377c7505fd10845b30a81f2d9..f9cff329b04848d1c8eadcaf4fa3d3dbe03d8af3 100644
--- a/Knot.files
+++ b/Knot.files
@@ -211,6 +211,13 @@ src/libknot/packet/wire.h
 src/libknot/processing/process.c
 src/libknot/processing/process.h
 src/libknot/rdata.h
+src/libknot/rdata/dname.h
+src/libknot/rdata/dnskey.h
+src/libknot/rdata/nsec.h
+src/libknot/rdata/nsec3.h
+src/libknot/rdata/nsec3param.h
+src/libknot/rdata/rrsig.h
+src/libknot/rdata/soa.h
 src/libknot/rr.c
 src/libknot/rr.h
 src/libknot/rrset-dump.c
diff --git a/src/Makefile.am b/src/Makefile.am
index cc67ce21a9516bb6c3319dac05cf4e3746611aa0..496283036a0c0f70c473d1d59feed44c875bb2f3 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -148,8 +148,6 @@ libknot_la_SOURCES =				\
 	libknot/dnssec/key.c			\
 	libknot/dnssec/key.h			\
 	libknot/dnssec/bitmap.h			\
-	libknot/dnssec/nsec3.c			\
-	libknot/dnssec/nsec3.h			\
 	libknot/dnssec/policy.c			\
 	libknot/dnssec/policy.h			\
 	libknot/dnssec/random.h			\
@@ -169,7 +167,18 @@ libknot_la_SOURCES =				\
 	libknot/packet/wire.h			\
 	libknot/processing/process.c		\
 	libknot/processing/process.h		\
-	libknot/rdata.h				\
+	libknot/rdata/dname.h			\
+	libknot/rdata/dnskey.h			\
+	libknot/rdata/nsec.h			\
+	libknot/rdata/nsec3.c			\
+	libknot/rdata/nsec3.h			\
+	libknot/rdata/nsec3param.h			\
+	libknot/rdata/nsec3param.c			\
+	libknot/rdata/nsec.h			\
+	libknot/rdata/rrsig.h			\
+	libknot/rdata/soa.h			\
+	libknot/rdata/tsig.c				\
+	libknot/rdata/tsig.h				\
 	libknot/rrset-dump.c			\
 	libknot/rrset-dump.h			\
 	libknot/rr.c				\
@@ -178,8 +187,6 @@ libknot_la_SOURCES =				\
 	libknot/rrset.h				\
 	libknot/tsig-op.c			\
 	libknot/tsig-op.h			\
-	libknot/tsig.c				\
-	libknot/tsig.h				\
 	libknot/util/endian.h			\
 	libknot/util/tolower.c			\
 	libknot/util/tolower.h			\
diff --git a/src/knot/conf/conf.h b/src/knot/conf/conf.h
index 381ef32afb15e16c2c8ca3241b037cbf498718e9..217fa1a6a195acae60cca5d15474c0c99288d6cf 100644
--- a/src/knot/conf/conf.h
+++ b/src/knot/conf/conf.h
@@ -35,7 +35,7 @@
 #include <urcu.h>
 
 #include "libknot/dname.h"
-#include "libknot/tsig.h"
+#include "libknot/rdata/tsig.h"
 #include "libknot/dnssec/key.h"
 #include "libknot/dnssec/policy.h"
 #include "common/lists.h"
diff --git a/src/knot/ctl/remote.c b/src/knot/ctl/remote.c
index 68e5ea20cf460f7eb6b5648b5f5d12e0e2a751f3..177f765db68171346a5103894532b1c739ba84d8 100644
--- a/src/knot/ctl/remote.c
+++ b/src/knot/ctl/remote.c
@@ -26,7 +26,8 @@
 #include "libknot/packet/wire.h"
 #include "common/descriptor.h"
 #include "libknot/tsig-op.h"
-#include "libknot/rdata.h"
+#include "libknot/rdata/dname.h"
+#include "libknot/rdata/soa.h"
 #include "libknot/dnssec/random.h"
 #include "knot/dnssec/zone-sign.h"
 #include "knot/dnssec/zone-nsec.h"
diff --git a/src/knot/dnssec/nsec-chain.c b/src/knot/dnssec/nsec-chain.c
index f2547054b0f462b06ef9856a6cfdd454f25c99a3..c960cf1b6af8afa0a316949af23eb9c32eff80d6 100644
--- a/src/knot/dnssec/nsec-chain.c
+++ b/src/knot/dnssec/nsec-chain.c
@@ -17,7 +17,6 @@
 #include <assert.h>
 #include <stdint.h>
 
-#include "libknot/rdata.h"
 #include "common/debug.h"
 #include "knot/dnssec/nsec-chain.h"
 #include "knot/dnssec/zone-sign.h"
diff --git a/src/knot/dnssec/nsec3-chain.c b/src/knot/dnssec/nsec3-chain.c
index 23b90d70c806aac096dfdfa060c23cad37aed017..cf3fc321c2da0093d2ac16e4e68053c1c2e0767e 100644
--- a/src/knot/dnssec/nsec3-chain.c
+++ b/src/knot/dnssec/nsec3-chain.c
@@ -19,7 +19,6 @@
 #include "common/base32hex.h"
 #include "knot/dnssec/nsec3-chain.h"
 #include "libknot/dname.h"
-#include "libknot/rdata.h"
 #include "libknot/packet/wire.h"
 #include "knot/zone/zone-contents.h"
 #include "knot/zone/zone-diff.h"
@@ -27,6 +26,7 @@
 #include "knot/dnssec/zone-sign.h"
 #include "knot/dnssec/zone-nsec.h"
 #include "libknot/dnssec/bitmap.h"
+#include "libknot/rdata/nsec3.h"
 
 /* - Forward declarations --------------------------------------------------- */
 
diff --git a/src/knot/dnssec/zone-keys.c b/src/knot/dnssec/zone-keys.c
index 2ec945f0112b52842cb1146728a77dbe0927c2b5..5946e18bae6f620c698f43b5bfb3d1a256fdbfe4 100644
--- a/src/knot/dnssec/zone-keys.c
+++ b/src/knot/dnssec/zone-keys.c
@@ -18,16 +18,16 @@
 #include <dirent.h>
 #include <stdbool.h>
 #include <inttypes.h>
+
+#include "common/debug.h"
 #include "common/errcode.h"
 #include "common/mempattern.h"
 #include "libknot/common.h"
 #include "libknot/dname.h"
 #include "libknot/consts.h"
-#include "libknot/dnssec/nsec3.h"
+#include "libknot/rdata/dnskey.h"
 #include "libknot/dnssec/sign.h"
 #include "knot/dnssec/zone-keys.h"
-#include "libknot/rdata.h"
-#include "common/debug.h"
 
 /*!
  * \brief Free DNSSEC signing context for each key.
diff --git a/src/knot/dnssec/zone-nsec.c b/src/knot/dnssec/zone-nsec.c
index ade08a681ea6ab621417c9c05e6ba36480caa8cd..e766809a091d3b54ed1bcb41e986be4e7e162774 100644
--- a/src/knot/dnssec/zone-nsec.c
+++ b/src/knot/dnssec/zone-nsec.c
@@ -21,18 +21,18 @@
 #include <limits.h>
 
 #include "common/base32hex.h"
+#include "common/debug.h"
 #include "common/descriptor.h"
 #include "common/hhash.h"
+#include "libknot/dnssec/bitmap.h"
+#include "libknot/util/utils.h"
+#include "libknot/packet/wire.h"
+#include "libknot/rdata/soa.h"
+#include "libknot/rdata/nsec3.h"
 #include "knot/dnssec/nsec-chain.h"
 #include "knot/dnssec/nsec3-chain.h"
-#include "libknot/dnssec/bitmap.h"
-#include "libknot/dnssec/nsec3.h"
 #include "knot/dnssec/zone-nsec.h"
 #include "knot/dnssec/zone-sign.h"
-#include "libknot/rdata.h"
-#include "common/debug.h"
-#include "libknot/util/utils.h"
-#include "libknot/packet/wire.h"
 #include "knot/zone/zone-contents.h"
 #include "knot/zone/zone-diff.h"
 
diff --git a/src/knot/dnssec/zone-sign.c b/src/knot/dnssec/zone-sign.c
index 177c4594c4f1bc5d5d08fba54aa8f4e45626a97e..960a7d98217b2d7bc9a559278efe25c0c9a55a15 100644
--- a/src/knot/dnssec/zone-sign.c
+++ b/src/knot/dnssec/zone-sign.c
@@ -19,21 +19,24 @@
 #include <stdint.h>
 #include <sys/types.h>
 #include <time.h>
+
+#include "common/debug.h"
 #include "common/descriptor.h"
 #include "common/errcode.h"
 #include "common/hattrie/hat-trie.h"
 #include "libknot/common.h"
 #include "libknot/dname.h"
+#include "libknot/rrset.h"
 #include "libknot/dnssec/key.h"
 #include "libknot/dnssec/policy.h"
 #include "libknot/dnssec/rrset-sign.h"
 #include "libknot/dnssec/sign.h"
+#include "libknot/rdata/dname.h"
+#include "libknot/rdata/rrsig.h"
+#include "libknot/rdata/soa.h"
 #include "knot/dnssec/zone-keys.h"
 #include "knot/dnssec/zone-sign.h"
-#include "libknot/rdata.h"
-#include "libknot/rrset.h"
 #include "knot/updates/changesets.h"
-#include "common/debug.h"
 #include "knot/zone/node.h"
 #include "knot/zone/zone-contents.h"
 
diff --git a/src/knot/nameserver/internet.c b/src/knot/nameserver/internet.c
index fbffd55513fccecc28bcb13bc4d087a094b81fdc..2dda62b36c66c0095c9546cf406b6de61bd50ef8 100644
--- a/src/knot/nameserver/internet.c
+++ b/src/knot/nameserver/internet.c
@@ -1,13 +1,30 @@
+/*  Copyright (C) 2013 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "common/debug.h"
+#include "common/descriptor.h"
+#include "libknot/common.h"
+#include "libknot/rdata/dname.h"
+#include "libknot/rdata/soa.h"
+#include "libknot/dnssec/rrset-sign.h"
 #include "knot/nameserver/internet.h"
 #include "knot/nameserver/nsec_proofs.h"
 #include "knot/nameserver/process_query.h"
 #include "knot/zone/zonedb.h"
-#include "libknot/common.h"
-#include "libknot/rdata.h"
-#include "common/debug.h"
-#include "common/descriptor.h"
 #include "knot/server/zones.h"
-#include "libknot/dnssec/rrset-sign.h"
 
 /*! \brief Check if given node was already visited. */
 static int wildcard_has_visited(struct query_data *qdata, const knot_node_t *node)
diff --git a/src/knot/nameserver/ixfr.c b/src/knot/nameserver/ixfr.c
index 422d7aab0e758a2193d31a5888c9ecf1a03b73ca..9f1c397fb78970d44ca0a1b453832c3bc251eb9b 100644
--- a/src/knot/nameserver/ixfr.c
+++ b/src/knot/nameserver/ixfr.c
@@ -3,10 +3,10 @@
 #include "knot/nameserver/internet.h"
 #include "knot/nameserver/process_query.h"
 #include "common/debug.h"
-#include "libknot/rdata.h"
 #include "knot/server/zones.h"
 #include "common/descriptor.h"
 #include "libknot/util/utils.h"
+#include "libknot/rdata/soa.h"
 
 /*! \brief Current IXFR answer sections. */
 enum {
diff --git a/src/knot/nameserver/nsec_proofs.c b/src/knot/nameserver/nsec_proofs.c
index 1fa9e4cd71ad0e0539e94ba0d95c29469c002b1b..142f88615cc53664ce81fa41abfbd4ed6006d3e2 100644
--- a/src/knot/nameserver/nsec_proofs.c
+++ b/src/knot/nameserver/nsec_proofs.c
@@ -4,7 +4,6 @@
 #include "knot/dnssec/zone-nsec.h"
 
 #include "libknot/common.h"
-#include "libknot/rdata.h"
 #include "common/debug.h"
 
 #define DNSSEC_ENABLED 1
diff --git a/src/knot/server/notify.c b/src/knot/server/notify.c
index 5efc59c9debc5c48b7c06102cc3e217733d103ef..06a79fa0cda563618ebabcfb227c4f87dbd25f92 100644
--- a/src/knot/server/notify.c
+++ b/src/knot/server/notify.c
@@ -31,11 +31,11 @@
 #include "common/evsched.h"
 #include "knot/other/debug.h"
 #include "knot/server/server.h"
-#include "libknot/rdata.h"
 #include "knot/nameserver/internet.h"
 #include "common/debug.h"
 #include "knot/nameserver/process_query.h"
 #include "libknot/dnssec/random.h"
+#include "libknot/rdata/soa.h"
 
 /*----------------------------------------------------------------------------*/
 /* API functions                                                              */
diff --git a/src/knot/server/zone-load.c b/src/knot/server/zone-load.c
index 6edf5f32284f91277a78b74131e93665f0979521..ace12f315015a867658a874f5a4eacb2d7bc49fb 100644
--- a/src/knot/server/zone-load.c
+++ b/src/knot/server/zone-load.c
@@ -26,7 +26,7 @@
 #include "libknot/dname.h"
 #include "libknot/dnssec/crypto.h"
 #include "libknot/dnssec/random.h"
-#include "libknot/rdata.h"
+#include "libknot/rdata/soa.h"
 #include "knot/zone/zone.h"
 #include "knot/zone/zone.h"
 #include "knot/zone/zonedb.h"
diff --git a/src/knot/server/zones.c b/src/knot/server/zones.c
index bd3538966f09d52ebc93d33ab19b62c1add7ea1f..769097e99d1477c9d1b99c5acfa83f7a508b46ab 100644
--- a/src/knot/server/zones.c
+++ b/src/knot/server/zones.c
@@ -31,10 +31,10 @@
 #include "knot/zone/zone-dump.h"
 #include "libknot/dname.h"
 #include "libknot/dnssec/random.h"
+#include "libknot/rdata/soa.h"
 #include "knot/dnssec/zone-events.h"
 #include "knot/dnssec/zone-sign.h"
 #include "knot/nameserver/chaos.h"
-#include "libknot/rdata.h"
 #include "libknot/tsig-op.h"
 #include "knot/updates/changesets.h"
 #include "knot/updates/ddns.h"
diff --git a/src/knot/updates/acl.c b/src/knot/updates/acl.c
index 595915e700093028898c83e837f6ad74f2e5cf5f..3be5a74e0dfa5ba662bac5a79b1fa33c741a9ca1 100644
--- a/src/knot/updates/acl.c
+++ b/src/knot/updates/acl.c
@@ -25,7 +25,7 @@
 #include "common/errcode.h"
 #include "knot/updates/acl.h"
 #include "libknot/util/endian.h"
-#include "libknot/tsig.h"
+#include "libknot/rdata/tsig.h"
 
 static inline uint32_t ipv4_chunk(const struct sockaddr_in *ipv4)
 {
diff --git a/src/knot/updates/acl.h b/src/knot/updates/acl.h
index 64fa3b63c21cc2b0f2e743a3d48fb6dca2a66216..21219030cba24a3d35853a58546603dc4a35c897 100644
--- a/src/knot/updates/acl.h
+++ b/src/knot/updates/acl.h
@@ -33,7 +33,7 @@
 #include "common/lists.h"
 #include "common/sockaddr.h"
 #include "common/mempattern.h"
-#include "libknot/tsig.h"
+#include "libknot/rdata/tsig.h"
 
 struct knot_tsig_key;
 
diff --git a/src/knot/updates/changesets.c b/src/knot/updates/changesets.c
index 0acb99476a8b1e9062ee1b2e537f8cb4e5af75a8..04bd110149e4d75cf133c2b5d7ca7777afb1708e 100644
--- a/src/knot/updates/changesets.c
+++ b/src/knot/updates/changesets.c
@@ -24,8 +24,8 @@
 #include "common/mempattern.h"
 #include "common/mempool.h"
 #include "libknot/rrset.h"
+#include "libknot/rdata/soa.h"
 #include "common/debug.h"
-#include "libknot/rdata.h"
 
 int knot_changesets_init(knot_changesets_t **changesets)
 {
diff --git a/src/knot/updates/ddns.c b/src/knot/updates/ddns.c
index f8637a7f36d7863f1e38bc0eb2d2de9ce6c52579..e6bf7fb8e1c3efc3fe87aba07956635777be7180 100644
--- a/src/knot/updates/ddns.c
+++ b/src/knot/updates/ddns.c
@@ -22,11 +22,11 @@
 #include "knot/updates/changesets.h"
 #include "knot/updates/xfr-in.h"
 #include "knot/zone/semantic-check.h"
-#include "libknot/rdata.h"
 #include "common/debug.h"
 #include "libknot/packet/pkt.h"
 #include "libknot/common.h"
 #include "libknot/consts.h"
+#include "libknot/rdata/soa.h"
 #include "common/mempattern.h"
 #include "common/descriptor.h"
 #include "common/lists.h"
diff --git a/src/knot/updates/xfr-in.c b/src/knot/updates/xfr-in.c
index 90f4e83c86377e1d26f627e7e016fffdbcb7ee6c..f384b50e1826d795d44f49744c3be2564c7c3874 100644
--- a/src/knot/updates/xfr-in.c
+++ b/src/knot/updates/xfr-in.c
@@ -32,13 +32,13 @@
 #include "libknot/dnssec/random.h"
 #include "libknot/common.h"
 #include "knot/updates/changesets.h"
-#include "libknot/tsig.h"
+#include "libknot/rdata/tsig.h"
 #include "libknot/tsig-op.h"
 #include "knot/zone/semantic-check.h"
 #include "common/lists.h"
 #include "common/descriptor.h"
-#include "libknot/rdata.h"
 #include "libknot/util/utils.h"
+#include "libknot/rdata/soa.h"
 
 #define KNOT_NS_TSIG_FREQ 100
 
diff --git a/src/knot/zone/node.c b/src/knot/zone/node.c
index 8a131da05a5e79c1a059b02e87b09287b4134911..c5b4415f0404f8218b64f5dc18bcbcada97d6cb2 100644
--- a/src/knot/zone/node.c
+++ b/src/knot/zone/node.c
@@ -24,7 +24,7 @@
 #include "knot/zone/node.h"
 #include "libknot/rrset.h"
 #include "libknot/rr.h"
-#include "libknot/rdata.h"
+#include "libknot/rdata/rrsig.h"
 #include "common/descriptor.h"
 #include "common/debug.h"
 #include "common/mempattern.h"
diff --git a/src/knot/zone/semantic-check.c b/src/knot/zone/semantic-check.c
index 5135adb978fe1c49125e8062abcc067a8612e7dd..09c471b7219c18b2dc52d2d03eaff6798dbf4676 100644
--- a/src/knot/zone/semantic-check.c
+++ b/src/knot/zone/semantic-check.c
@@ -26,11 +26,14 @@
 #include "libknot/libknot.h"
 #include "libknot/dnssec/key.h"
 #include "libknot/dnssec/rrset-sign.h"
+#include "libknot/rdata/rrsig.h"
+#include "libknot/rdata/soa.h"
+#include "libknot/rdata/nsec.h"
+#include "libknot/rdata/nsec3.h"
 #include "common/base32hex.h"
 #include "common/crc.h"
 #include "common/descriptor.h"
 #include "common/mempattern.h"
-#include "libknot/rdata.h"
 #include "knot/dnssec/zone-nsec.h"
 
 #include "knot/zone/semantic-check.h"
diff --git a/src/knot/zone/zone-contents.c b/src/knot/zone/zone-contents.c
index ff9155fe2958eb6b5e4d750b542285b05384e034..3b6a7e057c65f5ba3023cc89f372cf77cf057d0d 100644
--- a/src/knot/zone/zone-contents.c
+++ b/src/knot/zone/zone-contents.c
@@ -27,7 +27,10 @@
 #include "knot/zone/zone-tree.h"
 #include "libknot/packet/wire.h"
 #include "libknot/consts.h"
-#include "libknot/rdata.h"
+#include "libknot/rdata/rrsig.h"
+#include "libknot/rdata/nsec3.h"
+#include "libknot/rdata/soa.h"
+#include "libknot/rdata/dname.h"
 
 /*----------------------------------------------------------------------------*/
 /* Non-API functions                                                          */
diff --git a/src/knot/zone/zone-contents.h b/src/knot/zone/zone-contents.h
index 4331a98451d340da117c68dcaf1b96d14133423f..01ed95c234061b3de57c9f1a3d7e4db88d06e9a5 100644
--- a/src/knot/zone/zone-contents.h
+++ b/src/knot/zone/zone-contents.h
@@ -27,10 +27,9 @@
 #ifndef _KNOT_ZONE_CONTENTS_H_
 #define _KNOT_ZONE_CONTENTS_H_
 
-#include "knot/zone/node.h"
-#include "libknot/dnssec/nsec3.h"
 #include "common/lists.h"
-
+#include "libknot/rdata/nsec3param.h"
+#include "knot/zone/node.h"
 #include "knot/zone/zone-tree.h"
 
 struct zone_t;
diff --git a/src/knot/zone/zone-create.c b/src/knot/zone/zone-create.c
index cc6fd779662d7f66bd07ffb003364cbc2aa5fd3b..a8f8c3567d0d6185884e11235efcd96c287ab573 100644
--- a/src/knot/zone/zone-create.c
+++ b/src/knot/zone/zone-create.c
@@ -34,7 +34,6 @@
 #include "knot/other/debug.h"
 #include "knot/zone/zone-create.h"
 #include "zscanner/zscanner.h"
-#include "libknot/rdata.h"
 
 void process_error(const zs_scanner_t *s)
 {
diff --git a/src/knot/zone/zone-diff.c b/src/knot/zone/zone-diff.c
index 43cd8bb545e00dfe7098bd7fa3b0726260b49973..9d5dacca79b78880c264625c600809c20c3e7037 100644
--- a/src/knot/zone/zone-diff.c
+++ b/src/knot/zone/zone-diff.c
@@ -22,8 +22,8 @@
 #include "common/errcode.h"
 #include "knot/zone/zone-diff.h"
 #include "common/descriptor.h"
-#include "libknot/rdata.h"
 #include "libknot/util/utils.h"
+#include "libknot/rdata/soa.h"
 
 struct zone_diff_param {
 	knot_zone_tree_t *nodes;
diff --git a/src/knot/zone/zone.c b/src/knot/zone/zone.c
index 09f6ffa3363a77178e1635dc4e337b37da361192..fb74707730ef67d8102f11e950fa9435a63f31c2 100644
--- a/src/knot/zone/zone.c
+++ b/src/knot/zone/zone.c
@@ -27,7 +27,6 @@
 #include "libknot/common.h"
 #include "libknot/dname.h"
 #include "libknot/dnssec/random.h"
-#include "libknot/rdata.h"
 #include "libknot/util/utils.h"
 
 /*!
diff --git a/src/libknot/dnssec/key.c b/src/libknot/dnssec/key.c
index 45edbefe34f52b6744e117ece6093f92ceb4b1be..ce0438e431d201800342992d224062c13bf56c31 100644
--- a/src/libknot/dnssec/key.c
+++ b/src/libknot/dnssec/key.c
@@ -32,7 +32,7 @@
 #include "libknot/dname.h"
 #include "libknot/dnssec/key.h"
 #include "libknot/dnssec/sig0.h"
-#include "libknot/tsig.h"
+#include "libknot/rdata/tsig.h"
 #include "zscanner/zscanner.h"
 
 /*!
diff --git a/src/libknot/dnssec/key.h b/src/libknot/dnssec/key.h
index 789e3ad9a15cf41ef8acd9db0cf4a377d5aabf24..6294b6a34399c088021da735d989be84d6d0f11d 100644
--- a/src/libknot/dnssec/key.h
+++ b/src/libknot/dnssec/key.h
@@ -31,7 +31,7 @@
 #include <time.h>
 #include "libknot/dname.h"
 #include "libknot/binary.h"
-#include "libknot/tsig.h"
+#include "libknot/rdata/tsig.h"
 
 /*----------------------------------------------------------------------------*/
 
diff --git a/src/libknot/dnssec/rrset-sign.c b/src/libknot/dnssec/rrset-sign.c
index 737cfdf1b808c1cf38c2f9740a4313b7943d54d9..7501ddeb2652731d5c02c28fa605d1e3fd82415a 100644
--- a/src/libknot/dnssec/rrset-sign.c
+++ b/src/libknot/dnssec/rrset-sign.c
@@ -24,8 +24,8 @@
 #include "libknot/dnssec/policy.h"
 #include "libknot/dnssec/rrset-sign.h"
 #include "libknot/dnssec/sign.h"
-#include "libknot/rdata.h"
 #include "libknot/rrset.h"
+#include "libknot/rdata/rrsig.h"
 
 #define MAX_RR_WIREFORMAT_SIZE (64 * 1024)
 #define RRSIG_RDATA_SIGNER_OFFSET 18
diff --git a/src/libknot/libknot.h b/src/libknot/libknot.h
index cdb6215346660d4fd1fd402aa05a4d2d40dc88aa..48bfbcce4c65f293140b12cf3e71f9ce8d05b814 100644
--- a/src/libknot/libknot.h
+++ b/src/libknot/libknot.h
@@ -33,13 +33,20 @@
 #include "libknot/packet/wire.h"
 #include "libknot/packet/compr.h"
 #include "libknot/packet/pkt.h"
+#include "libknot/rr.h"
 #include "libknot/rrset.h"
 #include "libknot/rrset-dump.h"
-#include "libknot/tsig.h"
+#include "libknot/rdata/dname.h"
+#include "libknot/rdata/dnskey.h"
+#include "libknot/rdata/nsec3.h"
+#include "libknot/rdata/nsec3param.h"
+#include "libknot/rdata/nsec.h"
+#include "libknot/rdata/rrsig.h"
+#include "libknot/rdata/soa.h"
+#include "libknot/rdata/tsig.h"
 #include "libknot/tsig-op.h"
 #include "libknot/util/tolower.h"
 #include "libknot/util/utils.h"
-#include "libknot/rdata.h"
 
 #endif
 
diff --git a/src/libknot/packet/pkt.c b/src/libknot/packet/pkt.c
index 82bb1905995e277d5d4453555aefa9b8e8149631..929e22c114a5d1be54fcbaeb47c0cb675e890596 100644
--- a/src/libknot/packet/pkt.c
+++ b/src/libknot/packet/pkt.c
@@ -23,7 +23,7 @@
 #include "libknot/common.h"
 #include "common/descriptor.h"
 #include "libknot/packet/wire.h"
-#include "libknot/tsig.h"
+#include "libknot/rdata/tsig.h"
 #include "libknot/tsig-op.h"
 
 /*! \brief Scan packet for RRSet existence. */
diff --git a/src/libknot/processing/process.h b/src/libknot/processing/process.h
index a6bc1060ea087a4885b9140e8a05251310f4fe37..5977cd556ea4dea34133eb8f234b9318c2d1b6e0 100644
--- a/src/libknot/processing/process.h
+++ b/src/libknot/processing/process.h
@@ -29,7 +29,7 @@
 
 #include "common/mempattern.h"
 #include "libknot/consts.h"
-#include "libknot/tsig.h"
+#include "libknot/rdata/tsig.h"
 #include "libknot/packet/pkt.h"
 
 /*! \brief Main packet processing states.
diff --git a/src/libknot/rdata.h b/src/libknot/rdata.h
deleted file mode 100644
index fc7f9a0431568330984fb9ac3013b594f66db9c2..0000000000000000000000000000000000000000
--- a/src/libknot/rdata.h
+++ /dev/null
@@ -1,406 +0,0 @@
-/*!
- * \file rdata.h
- *
- * \author Lubos Slovak <lubos.slovak@nic.cz>
- *
- * \brief API for manipulating RDATA contents.
- *
- * \addtogroup libknot
- * @{
- */
-/*  Copyright (C) 2013 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
-
-    This program is free software: you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation, either version 3 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-#ifndef _KNOT_RDATA_H_
-#define _KNOT_RDATA_H_
-
-#include "common/descriptor.h"
-#include "libknot/dname.h"
-#include "libknot/rr.h"
-#include "libknot/util/utils.h"
-
-#define KNOT_RDATA_DNSKEY_FLAG_KSK 1
-
-#define RRS_CHECK(rrs, pos, code) \
-	if (rrs == NULL || rrs->data == NULL || rrs->rr_count == 0 || \
-	    pos >= rrs->rr_count) { \
-		code; \
-	}
-
-static inline uint8_t *data_offset(const knot_rrs_t *rrs, size_t pos,
-                                   size_t offset) {
-	knot_rr_t *rr = knot_rrs_rr(rrs, pos);
-	return knot_rr_rdata(rr) + offset;
-}
-
-static inline
-const knot_dname_t *knot_rrs_cname_name(const knot_rrs_t *rrs)
-{
-	RRS_CHECK(rrs, 0, return NULL);
-	return data_offset(rrs, 0, 0);
-}
-
-static inline
-const knot_dname_t *knot_rrs_dname_target(const knot_rrs_t *rrs)
-{
-	RRS_CHECK(rrs, 0, return NULL);
-	return data_offset(rrs, 0, 0);
-}
-
-static inline
-const knot_dname_t *knot_rrs_soa_primary_ns(const knot_rrs_t *rrs)
-{
-	RRS_CHECK(rrs, 0, return NULL);
-	return data_offset(rrs, 0, 0);
-}
-
-static inline
-const knot_dname_t *knot_rrs_soa_mailbox(const knot_rrs_t *rrs)
-{
-	RRS_CHECK(rrs, 0, return NULL);
-	return data_offset(rrs, 0, knot_dname_size(knot_rrs_soa_primary_ns(rrs)));
-}
-
-static inline
-size_t knot_rrs_soa_names_len(const knot_rrs_t *rrs)
-{
-	RRS_CHECK(rrs, 0, return 0);
-	return knot_dname_size(knot_rrs_soa_primary_ns(rrs))
-	       + knot_dname_size(knot_rrs_soa_mailbox(rrs));
-}
-
-static inline
-uint32_t knot_rrs_soa_serial(const knot_rrs_t *rrs)
-{
-	RRS_CHECK(rrs, 0, return 0);
-	return knot_wire_read_u32(data_offset(rrs, 0,
-	                                      knot_rrs_soa_names_len(rrs)));
-}
-
-static inline
-void knot_rrs_soa_serial_set(knot_rrs_t *rrs, uint32_t serial)
-{
-	RRS_CHECK(rrs, 0, return);
-	// the number is in network byte order, transform it
-	knot_wire_write_u32(data_offset(rrs, 0, knot_rrs_soa_names_len(rrs)),
-	                    serial);
-}
-
-static inline
-uint32_t knot_rrs_soa_refresh(const knot_rrs_t *rrs)
-{
-	RRS_CHECK(rrs, 0, return 0);
-	return knot_wire_read_u32(data_offset(rrs, 0,
-	                                      knot_rrs_soa_names_len(rrs) + 4));
-}
-
-static inline
-uint32_t knot_rrs_soa_retry(const knot_rrs_t *rrs)
-{
-	RRS_CHECK(rrs, 0, return 0);
-	return knot_wire_read_u32(data_offset(rrs, 0,
-	                                      knot_rrs_soa_names_len(rrs) + 8));
-}
-
-static inline
-uint32_t knot_rrs_soa_expire(const knot_rrs_t *rrs)
-{
-	RRS_CHECK(rrs, 0, return 0);
-	return knot_wire_read_u32(data_offset(rrs, 0,
-	                                      knot_rrs_soa_names_len(rrs) + 12));
-}
-
-static inline
-uint32_t knot_rrs_soa_minimum(const knot_rrs_t *rrs)
-{
-	RRS_CHECK(rrs, 0, return 0);
-	return knot_wire_read_u32(data_offset(rrs, 0,
-	                                      knot_rrs_soa_names_len(rrs) + 16));
-}
-
-static inline
-uint16_t knot_rrs_rrsig_type_covered(const knot_rrs_t *rrs, size_t pos)
-{
-	RRS_CHECK(rrs, pos, return 0);
-	return knot_wire_read_u16(data_offset(rrs, pos, 0));
-}
-
-static inline
-uint8_t knot_rrs_rrsig_algorithm(const knot_rrs_t *rrs, size_t pos)
-{
-	RRS_CHECK(rrs, pos, return 0);
-	return *data_offset(rrs, pos, 2);
-}
-
-static inline
-uint8_t knot_rrs_rrsig_labels(const knot_rrs_t *rrs, size_t pos)
-{
-	RRS_CHECK(rrs, pos, return 0);
-	return *data_offset(rrs, pos, 3);
-}
-
-static inline
-uint32_t knot_rrs_rrsig_original_ttl(const knot_rrs_t *rrs, size_t pos)
-{
-	RRS_CHECK(rrs, pos, return 0);
-	return knot_wire_read_u32(data_offset(rrs, pos, 4));
-}
-
-static inline
-uint32_t knot_rrs_rrsig_sig_expiration(const knot_rrs_t *rrs, size_t pos)
-{
-	RRS_CHECK(rrs, pos, return 0);
-	return knot_wire_read_u32(data_offset(rrs, pos, 8));
-}
-
-static inline
-uint32_t knot_rrs_rrsig_sig_inception(const knot_rrs_t *rrs, size_t pos)
-{
-	RRS_CHECK(rrs, pos, return 0);
-	return knot_wire_read_u32(data_offset(rrs, pos, 12));
-}
-
-static inline
-uint16_t knot_rrs_rrsig_key_tag(const knot_rrs_t *rrs, size_t pos)
-{
-	RRS_CHECK(rrs, pos, return 0);
-	return knot_wire_read_u16(data_offset(rrs, pos, 16));
-}
-
-static inline
-const knot_dname_t *knot_rrs_rrsig_signer_name(const knot_rrs_t *rrs,
-                                                 size_t pos)
-{
-	RRS_CHECK(rrs, pos, return 0);
-	return data_offset(rrs, pos, 18);
-}
-
-static inline
-void knot_rrs_rrsig_signature(const knot_rrs_t *rrs, size_t pos,
-                                uint8_t **signature, size_t *signature_size)
-{
-	if (!signature || !signature_size) {
-		return;
-	}
-
-	if (rrs == NULL || pos >= rrs->rr_count) {
-		*signature = NULL;
-		*signature_size = 0;
-		return;
-	}
-
-	uint8_t *rdata = data_offset(rrs, pos, 0);
-	uint8_t *signer = rdata + 18;
-	const knot_rr_t *rr = knot_rrs_rr(rrs, pos);
-	size_t total_size = knot_rr_rdata_size(rr);
-	size_t header_size = 18 + knot_dname_size(signer);
-
-	*signature = rdata + header_size;
-	*signature_size = total_size - header_size;
-}
-
-static inline
-uint16_t knot_rrs_dnskey_flags(const knot_rrs_t *rrs, size_t pos)
-{
-	RRS_CHECK(rrs, pos, return 0);
-	return knot_wire_read_u16(data_offset(rrs, pos, 0));
-}
-
-static inline
-uint8_t knot_rrs_dnskey_proto(const knot_rrs_t *rrs, size_t pos)
-{
-	RRS_CHECK(rrs, pos, return 0);
-
-	return *data_offset(rrs, pos, 2);
-}
-
-static inline
-uint8_t knot_rrs_dnskey_alg(const knot_rrs_t *rrs, size_t pos)
-{
-	RRS_CHECK(rrs, pos, return 0);
-	return *data_offset(rrs, pos, 3);
-}
-
-static inline
-void knot_rrs_dnskey_key(const knot_rrs_t *rrs, size_t pos, uint8_t **key,
-                           uint16_t *key_size)
-{
-	RRS_CHECK(rrs, pos, return);
-	*key = data_offset(rrs, pos, 4);
-	const knot_rr_t *rr = knot_rrs_rr(rrs, pos);
-	*key_size = knot_rr_rdata_size(rr) - 4;
-}
-
-static inline
-const knot_dname_t *knot_rrs_nsec_next(const knot_rrs_t *rrs)
-{
-	RRS_CHECK(rrs, 0, return NULL);
-	return data_offset(rrs, 0, 0);
-}
-
-static inline
-void knot_rrs_nsec_bitmap(const knot_rrs_t *rrs,
-                            uint8_t **bitmap, uint16_t *size)
-{
-	RRS_CHECK(rrs, 0, return);
-	knot_rr_t *rr = knot_rrs_rr(rrs, 0);
-	int next_size = knot_dname_size(knot_rrs_nsec_next(rrs));
-
-	*bitmap = knot_rr_rdata(rr) + next_size;
-	*size = knot_rr_rdata_size(rr) - next_size;
-}
-
-static inline
-uint8_t knot_rrs_nsec3_algorithm(const knot_rrs_t *rrs, size_t pos)
-{
-	RRS_CHECK(rrs, pos, return 0);
-	return *data_offset(rrs, pos, 0);
-}
-
-static inline
-uint8_t knot_rrs_nsec3_flags(const knot_rrs_t *rrs, size_t pos)
-{
-	RRS_CHECK(rrs, pos, return 0);
-	return *data_offset(rrs, pos, 1);
-}
-
-static inline
-uint16_t knot_rrs_nsec3_iterations(const knot_rrs_t *rrs, size_t pos)
-{
-	RRS_CHECK(rrs, pos, return 0);
-	return knot_wire_read_u16(data_offset(rrs, pos, 2));
-}
-
-static inline
-uint8_t knot_rrs_nsec3_salt_length(const knot_rrs_t *rrs, size_t pos)
-{
-	RRS_CHECK(rrs, pos, return 0);
-	return *(data_offset(rrs, pos, 0) + 4);
-}
-
-static inline
-const uint8_t *knot_rrs_nsec3_salt(const knot_rrs_t *rrs, size_t pos)
-{
-	RRS_CHECK(rrs, pos, return NULL);
-	return data_offset(rrs, pos, 5);
-}
-
-static inline
-void knot_rrs_nsec3_next_hashed(const knot_rrs_t *rrs, size_t pos,
-                                  uint8_t **name, uint8_t *name_size)
-{
-	RRS_CHECK(rrs, pos, return);
-	uint8_t salt_size = knot_rrs_nsec3_salt_length(rrs, pos);
-	*name_size = *data_offset(rrs, pos, 4 + salt_size + 1);
-	*name = data_offset(rrs, pos, 4 + salt_size + 2);
-}
-
-static inline
-void knot_rrs_nsec3_bitmap(const knot_rrs_t *rrs, size_t pos,
-                             uint8_t **bitmap, uint16_t *size)
-{
-	RRS_CHECK(rrs, pos, return);
-
-	/* Bitmap is last, skip all the items. */
-	size_t offset = 6; //hash alg., flags, iterations, salt len., hash len.
-	offset += knot_rrs_nsec3_salt_length(rrs, pos); //salt
-
-	uint8_t *next_hashed = NULL;
-	uint8_t next_hashed_size = 0;
-	knot_rrs_nsec3_next_hashed(rrs, pos, &next_hashed, &next_hashed_size);
-	offset += next_hashed_size; //hash
-
-	*bitmap = data_offset(rrs, pos, offset);
-	const knot_rr_t *rr = knot_rrs_rr(rrs, pos);
-	*size = knot_rr_rdata_size(rr) - offset;
-}
-
-static inline
-uint8_t knot_rrs_nsec3param_algorithm(const knot_rrs_t *rrs, size_t pos)
-{
-	RRS_CHECK(rrs, pos, return 0);
-	return *data_offset(rrs, pos, 0);
-}
-
-static inline
-uint8_t knot_rrs_nsec3param_flags(const knot_rrs_t *rrs, size_t pos)
-{
-	RRS_CHECK(rrs, pos, return 0);
-	return *data_offset(rrs, pos, 1);
-}
-
-static inline
-uint16_t knot_rrs_nsec3param_iterations(const knot_rrs_t *rrs, size_t pos)
-{
-	RRS_CHECK(rrs, pos, return 0);
-	return knot_wire_read_u16(data_offset(rrs, pos, 2));
-}
-
-static inline
-uint8_t knot_rrs_nsec3param_salt_length(const knot_rrs_t *rrs, size_t pos)
-{
-	RRS_CHECK(rrs, pos, return 0);
-	return *data_offset(rrs, pos, 4);
-}
-
-static inline
-const uint8_t *knot_rrs_nsec3param_salt(const knot_rrs_t *rrs, size_t pos)
-{
-	RRS_CHECK(rrs, pos, return 0);
-	return data_offset(rrs, pos, 5);
-}
-
-static inline
-const knot_dname_t *knot_rrs_ns_name(const knot_rrs_t *rrs, size_t pos)
-{
-	RRS_CHECK(rrs, pos, return 0);
-	return data_offset(rrs, pos, 0);
-}
-
-static inline
-const knot_dname_t *knot_rrs_mx_name(const knot_rrs_t *rrs, size_t pos)
-{
-	RRS_CHECK(rrs, pos, return 0);
-	return data_offset(rrs, pos, 2);
-}
-
-static inline
-const knot_dname_t *knot_rrs_srv_name(const knot_rrs_t *rrs, size_t pos)
-{
-	RRS_CHECK(rrs, pos, return 0);
-	return data_offset(rrs, pos, 6);
-}
-
-static inline
-const knot_dname_t *knot_rrs_name(const knot_rrs_t *rrs, size_t pos,
-                                  uint16_t type)
-{
-	switch (type) {
-		case KNOT_RRTYPE_NS:
-			return knot_rrs_ns_name(rrs, pos);
-		case KNOT_RRTYPE_MX:
-			return knot_rrs_mx_name(rrs, pos);
-		case KNOT_RRTYPE_SRV:
-			return knot_rrs_srv_name(rrs, pos);
-		case KNOT_RRTYPE_CNAME:
-			return knot_rrs_cname_name(rrs);
-	}
-
-	return NULL;
-}
-
-#endif /* _KNOT_RDATA_H_ */
-/*! @} */
diff --git a/src/libknot/rdata/dname.h b/src/libknot/rdata/dname.h
new file mode 100644
index 0000000000000000000000000000000000000000..32f77fbf6e9bae1aa3591cc560ec2aa4b758627f
--- /dev/null
+++ b/src/libknot/rdata/dname.h
@@ -0,0 +1,74 @@
+/*  Copyright (C) 2014 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#pragma once
+
+#include "common/descriptor.h"
+#include "libknot/rr.h"
+#include "libknot/dname.h"
+
+static inline
+const knot_dname_t *knot_rrs_cname_name(const knot_rrs_t *rrs)
+{
+	RRS_CHECK(rrs, 0, return NULL);
+	return data_offset(rrs, 0, 0);
+}
+
+static inline
+const knot_dname_t *knot_rrs_dname_target(const knot_rrs_t *rrs)
+{
+	RRS_CHECK(rrs, 0, return NULL);
+	return data_offset(rrs, 0, 0);
+}
+
+static inline
+const knot_dname_t *knot_rrs_ns_name(const knot_rrs_t *rrs, size_t pos)
+{
+	RRS_CHECK(rrs, pos, return 0);
+	return data_offset(rrs, pos, 0);
+}
+
+static inline
+const knot_dname_t *knot_rrs_mx_name(const knot_rrs_t *rrs, size_t pos)
+{
+	RRS_CHECK(rrs, pos, return 0);
+	return data_offset(rrs, pos, 2);
+}
+
+static inline
+const knot_dname_t *knot_rrs_srv_name(const knot_rrs_t *rrs, size_t pos)
+{
+	RRS_CHECK(rrs, pos, return 0);
+	return data_offset(rrs, pos, 6);
+}
+
+static inline
+const knot_dname_t *knot_rrs_name(const knot_rrs_t *rrs, size_t pos,
+                                  uint16_t type)
+{
+	switch (type) {
+		case KNOT_RRTYPE_NS:
+			return knot_rrs_ns_name(rrs, pos);
+		case KNOT_RRTYPE_MX:
+			return knot_rrs_mx_name(rrs, pos);
+		case KNOT_RRTYPE_SRV:
+			return knot_rrs_srv_name(rrs, pos);
+		case KNOT_RRTYPE_CNAME:
+			return knot_rrs_cname_name(rrs);
+	}
+
+	return NULL;
+}
\ No newline at end of file
diff --git a/src/libknot/rdata/dnskey.h b/src/libknot/rdata/dnskey.h
new file mode 100644
index 0000000000000000000000000000000000000000..3e95317d622f9d1d0ab50aa5eb1e7346626287f6
--- /dev/null
+++ b/src/libknot/rdata/dnskey.h
@@ -0,0 +1,53 @@
+/*  Copyright (C) 2014 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#pragma once
+
+#include "libknot/rr.h"
+
+#define KNOT_RDATA_DNSKEY_FLAG_KSK 1
+
+static inline
+uint16_t knot_rrs_dnskey_flags(const knot_rrs_t *rrs, size_t pos)
+{
+	RRS_CHECK(rrs, pos, return 0);
+	return knot_wire_read_u16(data_offset(rrs, pos, 0));
+}
+
+static inline
+uint8_t knot_rrs_dnskey_proto(const knot_rrs_t *rrs, size_t pos)
+{
+	RRS_CHECK(rrs, pos, return 0);
+
+	return *data_offset(rrs, pos, 2);
+}
+
+static inline
+uint8_t knot_rrs_dnskey_alg(const knot_rrs_t *rrs, size_t pos)
+{
+	RRS_CHECK(rrs, pos, return 0);
+	return *data_offset(rrs, pos, 3);
+}
+
+static inline
+void knot_rrs_dnskey_key(const knot_rrs_t *rrs, size_t pos, uint8_t **key,
+                           uint16_t *key_size)
+{
+	RRS_CHECK(rrs, pos, return);
+	*key = data_offset(rrs, pos, 4);
+	const knot_rr_t *rr = knot_rrs_rr(rrs, pos);
+	*key_size = knot_rr_rdata_size(rr) - 4;
+}
\ No newline at end of file
diff --git a/src/libknot/rdata/nsec.h b/src/libknot/rdata/nsec.h
new file mode 100644
index 0000000000000000000000000000000000000000..935adc80d6941896ba4e57ab2e77a8bd3dbd09ac
--- /dev/null
+++ b/src/libknot/rdata/nsec.h
@@ -0,0 +1,38 @@
+/*  Copyright (C) 2014 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#pragma once
+
+#include "libknot/rr.h"
+
+static inline
+const knot_dname_t *knot_rrs_nsec_next(const knot_rrs_t *rrs)
+{
+	RRS_CHECK(rrs, 0, return NULL);
+	return data_offset(rrs, 0, 0);
+}
+
+static inline
+void knot_rrs_nsec_bitmap(const knot_rrs_t *rrs,
+                            uint8_t **bitmap, uint16_t *size)
+{
+	RRS_CHECK(rrs, 0, return);
+	knot_rr_t *rr = knot_rrs_rr(rrs, 0);
+	int next_size = knot_dname_size(knot_rrs_nsec_next(rrs));
+
+	*bitmap = knot_rr_rdata(rr) + next_size;
+	*size = knot_rr_rdata_size(rr) - next_size;
+}
\ No newline at end of file
diff --git a/src/libknot/dnssec/nsec3.c b/src/libknot/rdata/nsec3.c
similarity index 69%
rename from src/libknot/dnssec/nsec3.c
rename to src/libknot/rdata/nsec3.c
index f5c152ee0924513ec6812bda090a05b29042f7ab..f8e2691825b6132d2fc55ed8d21a469e09b8571d 100644
--- a/src/libknot/dnssec/nsec3.c
+++ b/src/libknot/rdata/nsec3.c
@@ -17,17 +17,10 @@
 #include <assert.h>
 #include <openssl/evp.h>
 #include <openssl/sha.h>
-#include <stdbool.h>
-#include <stdint.h>
-#include <stdlib.h>
-
-#include "common/descriptor.h"
-#include "common/memdup.h"
-#include "libknot/common.h"
-#include "libknot/consts.h"
-#include "libknot/dnssec/nsec3.h"
-#include "libknot/rdata.h"
+
+#include "libknot/rdata/nsec3.h"
 #include "libknot/util/tolower.h"
+#include "common/errcode.h"
 
 /*!
  * \brief Compute NSEC3 SHA1 hash.
@@ -102,49 +95,6 @@ static int nsec3_sha1(const uint8_t *salt, uint8_t salt_length,
 	return KNOT_EOK;
 }
 
-/* - public API -------------------------------------------------------------*/
-
-/*!
- * \brief Initialize the structure with NSEC3 params from NSEC3PARAM RR set.
- */
-int knot_nsec3_params_from_wire(knot_nsec3_params_t *params,
-                                const knot_rrs_t *rrs)
-{
-	if (params == NULL || rrs == NULL || rrs->rr_count == 0) {
-		return KNOT_EINVAL;
-	}
-
-	knot_nsec3_params_t result = { 0 };
-
-	result.algorithm   = knot_rrs_nsec3param_algorithm(rrs, 0);
-	result.iterations  = knot_rrs_nsec3param_iterations(rrs, 0);
-	result.flags       = knot_rrs_nsec3param_flags(rrs, 0);
-	result.salt_length = knot_rrs_nsec3param_salt_length(rrs, 0);
-
-	if (result.salt_length > 0) {
-		result.salt = knot_memdup(knot_rrs_nsec3param_salt(rrs, 0),
-		                          result.salt_length);
-		if (!result.salt) {
-			return KNOT_ENOMEM;
-		}
-	} else {
-		result.salt = NULL;
-	}
-
-	knot_nsec3_params_free(params);
-	*params = result;
-
-	return KNOT_EOK;
-}
-
-/*!
- * \brief Clean up structure with NSEC3 params (do not deallocate).
- */
-void knot_nsec3_params_free(knot_nsec3_params_t *params)
-{
-	free(params->salt);
-}
-
 /*!
  * \brief Compute NSEC3 hash for given data.
  */
diff --git a/src/libknot/dnssec/nsec3.h b/src/libknot/rdata/nsec3.h
similarity index 53%
rename from src/libknot/dnssec/nsec3.h
rename to src/libknot/rdata/nsec3.h
index 533adee112747aad5da053ab7b2b23145b60836c..b066f037daf5089f6c2ed1aca4f022994ab0dde3 100644
--- a/src/libknot/dnssec/nsec3.h
+++ b/src/libknot/rdata/nsec3.h
@@ -25,17 +25,80 @@
     along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-#ifndef _KNOT_DNSSEC_NSEC3_H_
-#define _KNOT_DNSSEC_NSEC3_H_
+#pragma once
 
 #include <stdbool.h>
 #include <stdint.h>
 #include <string.h>
 
 #include "libknot/consts.h"
-#include "libknot/rrset.h"
+#include "libknot/rr.h"
+#include "libknot/rdata/nsec3param.h"
 
-/*---------------------------------------------------------------------------*/
+static inline
+uint8_t knot_rrs_nsec3_algorithm(const knot_rrs_t *rrs, size_t pos)
+{
+	RRS_CHECK(rrs, pos, return 0);
+	return *data_offset(rrs, pos, 0);
+}
+
+static inline
+uint8_t knot_rrs_nsec3_flags(const knot_rrs_t *rrs, size_t pos)
+{
+	RRS_CHECK(rrs, pos, return 0);
+	return *data_offset(rrs, pos, 1);
+}
+
+static inline
+uint16_t knot_rrs_nsec3_iterations(const knot_rrs_t *rrs, size_t pos)
+{
+	RRS_CHECK(rrs, pos, return 0);
+	return knot_wire_read_u16(data_offset(rrs, pos, 2));
+}
+
+static inline
+uint8_t knot_rrs_nsec3_salt_length(const knot_rrs_t *rrs, size_t pos)
+{
+	RRS_CHECK(rrs, pos, return 0);
+	return *(data_offset(rrs, pos, 0) + 4);
+}
+
+static inline
+const uint8_t *knot_rrs_nsec3_salt(const knot_rrs_t *rrs, size_t pos)
+{
+	RRS_CHECK(rrs, pos, return NULL);
+	return data_offset(rrs, pos, 5);
+}
+
+static inline
+void knot_rrs_nsec3_next_hashed(const knot_rrs_t *rrs, size_t pos,
+                                  uint8_t **name, uint8_t *name_size)
+{
+	RRS_CHECK(rrs, pos, return);
+	uint8_t salt_size = knot_rrs_nsec3_salt_length(rrs, pos);
+	*name_size = *data_offset(rrs, pos, 4 + salt_size + 1);
+	*name = data_offset(rrs, pos, 4 + salt_size + 2);
+}
+
+static inline
+void knot_rrs_nsec3_bitmap(const knot_rrs_t *rrs, size_t pos,
+                             uint8_t **bitmap, uint16_t *size)
+{
+	RRS_CHECK(rrs, pos, return);
+
+	/* Bitmap is last, skip all the items. */
+	size_t offset = 6; //hash alg., flags, iterations, salt len., hash len.
+	offset += knot_rrs_nsec3_salt_length(rrs, pos); //salt
+
+	uint8_t *next_hashed = NULL;
+	uint8_t next_hashed_size = 0;
+	knot_rrs_nsec3_next_hashed(rrs, pos, &next_hashed, &next_hashed_size);
+	offset += next_hashed_size; //hash
+
+	*bitmap = data_offset(rrs, pos, offset);
+	const knot_rr_t *rr = knot_rrs_rr(rrs, pos);
+	*size = knot_rr_rdata_size(rr) - offset;
+}
 
 /*!
  * \brief Get length of the raw NSEC3 hash.
@@ -69,38 +132,6 @@ inline static size_t knot_nsec3_hash_b32_length(uint8_t algorithm)
 	}
 }
 
-/*---------------------------------------------------------------------------*/
-
-/*!
- * \brief Structure representing the NSEC3PARAM resource record.
- */
-typedef struct {
-	uint8_t algorithm;    //!< Hash algorithm.
-	uint8_t flags;        //!< Flags.
-	uint16_t iterations;  //!< Additional iterations of the hash function.
-	uint8_t salt_length;  //!< Length of the salt field in bytes.
-	uint8_t *salt;        //!< Salt used in hashing.
-} knot_nsec3_params_t;
-
-/*---------------------------------------------------------------------------*/
-
-/*!
- * \brief Initialize the structure with NSEC3 params from NSEC3PARAM RR set.
- *
- * \param params      Structure to initialize.
- * \param nsec3param  The NSEC3PARAM RRs.
- *
- * \return Error code, KNOT_EOK on success.
- */
-int knot_nsec3_params_from_wire(knot_nsec3_params_t *params,
-                                const knot_rrs_t *rrs);
-/*!
- * \brief Clean up structure with NSEC3 params (do not deallocate).
- *
- * \param params Structure with NSEC3 params.
- */
-void knot_nsec3_params_free(knot_nsec3_params_t *params);
-
 /*!
  * \brief Compute NSEC3 hash for given data.
  *
@@ -115,6 +146,4 @@ void knot_nsec3_params_free(knot_nsec3_params_t *params);
 int knot_nsec3_hash(const knot_nsec3_params_t *params, const uint8_t *data,
                     size_t size, uint8_t **digest, size_t *digest_size);
 
-#endif // _KNOT_DNSSEC_NSEC3_H_
-
 /*! @} */
diff --git a/src/libknot/rdata/nsec3param.c b/src/libknot/rdata/nsec3param.c
new file mode 100644
index 0000000000000000000000000000000000000000..020cfe0dae1238edbe6373c19a9e156f376527ae
--- /dev/null
+++ b/src/libknot/rdata/nsec3param.c
@@ -0,0 +1,60 @@
+/*  Copyright (C) 2011 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "common/memdup.h"
+#include "common/errcode.h"
+#include "libknot/rdata/nsec3param.h"
+
+/*!
+ * \brief Initialize the structure with NSEC3 params from NSEC3PARAM RR set.
+ */
+int knot_nsec3_params_from_wire(knot_nsec3_params_t *params,
+                                const knot_rrs_t *rrs)
+{
+	if (params == NULL || rrs == NULL || rrs->rr_count == 0) {
+		return KNOT_EINVAL;
+	}
+
+	knot_nsec3_params_t result = { 0 };
+
+	result.algorithm   = knot_rrs_nsec3param_algorithm(rrs, 0);
+	result.iterations  = knot_rrs_nsec3param_iterations(rrs, 0);
+	result.flags       = knot_rrs_nsec3param_flags(rrs, 0);
+	result.salt_length = knot_rrs_nsec3param_salt_length(rrs, 0);
+
+	if (result.salt_length > 0) {
+		result.salt = knot_memdup(knot_rrs_nsec3param_salt(rrs, 0),
+		                          result.salt_length);
+		if (!result.salt) {
+			return KNOT_ENOMEM;
+		}
+	} else {
+		result.salt = NULL;
+	}
+
+	knot_nsec3_params_free(params);
+	*params = result;
+
+	return KNOT_EOK;
+}
+
+/*!
+ * \brief Clean up structure with NSEC3 params (do not deallocate).
+ */
+void knot_nsec3_params_free(knot_nsec3_params_t *params)
+{
+	free(params->salt);
+}
diff --git a/src/libknot/rdata/nsec3param.h b/src/libknot/rdata/nsec3param.h
new file mode 100644
index 0000000000000000000000000000000000000000..823b9594fc14eb35e8c5e3d3f73b6021ac2d43cd
--- /dev/null
+++ b/src/libknot/rdata/nsec3param.h
@@ -0,0 +1,89 @@
+/*  Copyright (C) 2011 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#pragma once
+
+#include <stdbool.h>
+#include <stdint.h>
+#include <string.h>
+
+#include "libknot/consts.h"
+#include "libknot/rr.h"
+
+/*!
+ * \brief Structure representing the NSEC3PARAM resource record.
+ */
+typedef struct {
+	uint8_t algorithm;    //!< Hash algorithm.
+	uint8_t flags;        //!< Flags.
+	uint16_t iterations;  //!< Additional iterations of the hash function.
+	uint8_t salt_length;  //!< Length of the salt field in bytes.
+	uint8_t *salt;        //!< Salt used in hashing.
+} knot_nsec3_params_t;
+
+/*---------------------------------------------------------------------------*/
+
+static inline
+uint8_t knot_rrs_nsec3param_algorithm(const knot_rrs_t *rrs, size_t pos)
+{
+	RRS_CHECK(rrs, pos, return 0);
+	return *data_offset(rrs, pos, 0);
+}
+
+static inline
+uint8_t knot_rrs_nsec3param_flags(const knot_rrs_t *rrs, size_t pos)
+{
+	RRS_CHECK(rrs, pos, return 0);
+	return *data_offset(rrs, pos, 1);
+}
+
+static inline
+uint16_t knot_rrs_nsec3param_iterations(const knot_rrs_t *rrs, size_t pos)
+{
+	RRS_CHECK(rrs, pos, return 0);
+	return knot_wire_read_u16(data_offset(rrs, pos, 2));
+}
+
+static inline
+uint8_t knot_rrs_nsec3param_salt_length(const knot_rrs_t *rrs, size_t pos)
+{
+	RRS_CHECK(rrs, pos, return 0);
+	return *data_offset(rrs, pos, 4);
+}
+
+static inline
+const uint8_t *knot_rrs_nsec3param_salt(const knot_rrs_t *rrs, size_t pos)
+{
+	RRS_CHECK(rrs, pos, return 0);
+	return data_offset(rrs, pos, 5);
+}
+
+/*!
+ * \brief Initialize the structure with NSEC3 params from NSEC3PARAM RR set.
+ *
+ * \param params      Structure to initialize.
+ * \param nsec3param  The NSEC3PARAM RRs.
+ *
+ * \return Error code, KNOT_EOK on success.
+ */
+int knot_nsec3_params_from_wire(knot_nsec3_params_t *params,
+                                const knot_rrs_t *rrs);
+/*!
+ * \brief Clean up structure with NSEC3 params (do not deallocate).
+ *
+ * \param params Structure with NSEC3 params.
+ */
+void knot_nsec3_params_free(knot_nsec3_params_t *params);
diff --git a/src/libknot/rdata/rrsig.h b/src/libknot/rdata/rrsig.h
new file mode 100644
index 0000000000000000000000000000000000000000..3446c44a6c73f1954c79ad52e4b90378f9251784
--- /dev/null
+++ b/src/libknot/rdata/rrsig.h
@@ -0,0 +1,100 @@
+/*  Copyright (C) 2014 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#pragma once
+
+#include "libknot/rr.h"
+
+static inline
+uint16_t knot_rrs_rrsig_type_covered(const knot_rrs_t *rrs, size_t pos)
+{
+	RRS_CHECK(rrs, pos, return 0);
+	return knot_wire_read_u16(data_offset(rrs, pos, 0));
+}
+
+static inline
+uint8_t knot_rrs_rrsig_algorithm(const knot_rrs_t *rrs, size_t pos)
+{
+	RRS_CHECK(rrs, pos, return 0);
+	return *data_offset(rrs, pos, 2);
+}
+
+static inline
+uint8_t knot_rrs_rrsig_labels(const knot_rrs_t *rrs, size_t pos)
+{
+	RRS_CHECK(rrs, pos, return 0);
+	return *data_offset(rrs, pos, 3);
+}
+
+static inline
+uint32_t knot_rrs_rrsig_original_ttl(const knot_rrs_t *rrs, size_t pos)
+{
+	RRS_CHECK(rrs, pos, return 0);
+	return knot_wire_read_u32(data_offset(rrs, pos, 4));
+}
+
+static inline
+uint32_t knot_rrs_rrsig_sig_expiration(const knot_rrs_t *rrs, size_t pos)
+{
+	RRS_CHECK(rrs, pos, return 0);
+	return knot_wire_read_u32(data_offset(rrs, pos, 8));
+}
+
+static inline
+uint32_t knot_rrs_rrsig_sig_inception(const knot_rrs_t *rrs, size_t pos)
+{
+	RRS_CHECK(rrs, pos, return 0);
+	return knot_wire_read_u32(data_offset(rrs, pos, 12));
+}
+
+static inline
+uint16_t knot_rrs_rrsig_key_tag(const knot_rrs_t *rrs, size_t pos)
+{
+	RRS_CHECK(rrs, pos, return 0);
+	return knot_wire_read_u16(data_offset(rrs, pos, 16));
+}
+
+static inline
+const knot_dname_t *knot_rrs_rrsig_signer_name(const knot_rrs_t *rrs,
+                                                 size_t pos)
+{
+	RRS_CHECK(rrs, pos, return 0);
+	return data_offset(rrs, pos, 18);
+}
+
+static inline
+void knot_rrs_rrsig_signature(const knot_rrs_t *rrs, size_t pos,
+                                uint8_t **signature, size_t *signature_size)
+{
+	if (!signature || !signature_size) {
+		return;
+	}
+
+	if (rrs == NULL || pos >= rrs->rr_count) {
+		*signature = NULL;
+		*signature_size = 0;
+		return;
+	}
+
+	uint8_t *rdata = data_offset(rrs, pos, 0);
+	uint8_t *signer = rdata + 18;
+	const knot_rr_t *rr = knot_rrs_rr(rrs, pos);
+	size_t total_size = knot_rr_rdata_size(rr);
+	size_t header_size = 18 + knot_dname_size(signer);
+
+	*signature = rdata + header_size;
+	*signature_size = total_size - header_size;
+}
\ No newline at end of file
diff --git a/src/libknot/rdata/soa.h b/src/libknot/rdata/soa.h
new file mode 100644
index 0000000000000000000000000000000000000000..83ca99d05ac26caa3bc14acc88d8a933216fca94
--- /dev/null
+++ b/src/libknot/rdata/soa.h
@@ -0,0 +1,91 @@
+/*  Copyright (C) 2014 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#pragma once
+
+#include "libknot/rr.h"
+#include "libknot/dname.h"
+
+static inline
+const knot_dname_t *knot_rrs_soa_primary_ns(const knot_rrs_t *rrs)
+{
+	RRS_CHECK(rrs, 0, return NULL);
+	return data_offset(rrs, 0, 0);
+}
+
+static inline
+const knot_dname_t *knot_rrs_soa_mailbox(const knot_rrs_t *rrs)
+{
+	RRS_CHECK(rrs, 0, return NULL);
+	return data_offset(rrs, 0, knot_dname_size(knot_rrs_soa_primary_ns(rrs)));
+}
+
+static inline
+size_t knot_rrs_soa_names_len(const knot_rrs_t *rrs)
+{
+	RRS_CHECK(rrs, 0, return 0);
+	return knot_dname_size(knot_rrs_soa_primary_ns(rrs))
+	       + knot_dname_size(knot_rrs_soa_mailbox(rrs));
+}
+
+static inline
+uint32_t knot_rrs_soa_serial(const knot_rrs_t *rrs)
+{
+	RRS_CHECK(rrs, 0, return 0);
+	return knot_wire_read_u32(data_offset(rrs, 0,
+	                                      knot_rrs_soa_names_len(rrs)));
+}
+
+static inline
+void knot_rrs_soa_serial_set(knot_rrs_t *rrs, uint32_t serial)
+{
+	RRS_CHECK(rrs, 0, return);
+	// the number is in network byte order, transform it
+	knot_wire_write_u32(data_offset(rrs, 0, knot_rrs_soa_names_len(rrs)),
+	                    serial);
+}
+
+static inline
+uint32_t knot_rrs_soa_refresh(const knot_rrs_t *rrs)
+{
+	RRS_CHECK(rrs, 0, return 0);
+	return knot_wire_read_u32(data_offset(rrs, 0,
+	                                      knot_rrs_soa_names_len(rrs) + 4));
+}
+
+static inline
+uint32_t knot_rrs_soa_retry(const knot_rrs_t *rrs)
+{
+	RRS_CHECK(rrs, 0, return 0);
+	return knot_wire_read_u32(data_offset(rrs, 0,
+	                                      knot_rrs_soa_names_len(rrs) + 8));
+}
+
+static inline
+uint32_t knot_rrs_soa_expire(const knot_rrs_t *rrs)
+{
+	RRS_CHECK(rrs, 0, return 0);
+	return knot_wire_read_u32(data_offset(rrs, 0,
+	                                      knot_rrs_soa_names_len(rrs) + 12));
+}
+
+static inline
+uint32_t knot_rrs_soa_minimum(const knot_rrs_t *rrs)
+{
+	RRS_CHECK(rrs, 0, return 0);
+	return knot_wire_read_u32(data_offset(rrs, 0,
+	                                      knot_rrs_soa_names_len(rrs) + 16));
+}
\ No newline at end of file
diff --git a/src/libknot/tsig.c b/src/libknot/rdata/tsig.c
similarity index 99%
rename from src/libknot/tsig.c
rename to src/libknot/rdata/tsig.c
index c7c8ae75162a676f9198bfab2da6be7828edda64..2f510e05118d49b4e54ef971f9ba7d8aeaf49858 100644
--- a/src/libknot/tsig.c
+++ b/src/libknot/rdata/tsig.c
@@ -21,7 +21,7 @@
 #include <assert.h>
 #include <time.h>
 
-#include "libknot/tsig.h"
+#include "libknot/rdata/tsig.h"
 #include "common/debug.h"
 #include "libknot/common.h"
 #include "libknot/util/utils.h"
diff --git a/src/libknot/tsig.h b/src/libknot/rdata/tsig.h
similarity index 96%
rename from src/libknot/tsig.h
rename to src/libknot/rdata/tsig.h
index bd9d364bb818b859b63f67cf88d00093c65d027b..cfbb7dead0679a832c577836ac354a3a440535f2 100644
--- a/src/libknot/tsig.h
+++ b/src/libknot/rdata/tsig.h
@@ -15,7 +15,7 @@
     the Free Software Foundation, either version 3 of the License, or
     (at your option) any later version.
 
-    This program is distributed in the hope that it will be useful,
+    This program is distributed in the hope tha t it will be useful,
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
@@ -24,8 +24,7 @@
     along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-#ifndef _KNOT_TSIG_H_
-#define _KNOT_TSIG_H_
+#pragma once
 
 #include <stdint.h>
 
@@ -139,6 +138,4 @@ size_t tsig_wire_actsize(const knot_rrset_t *tsig);
 
 int tsig_rdata_is_ok(const knot_rrset_t *tsig);
 
-#endif /* _KNOT_TSIG_H_ */
-
 /*! @} */
diff --git a/src/libknot/rr.c b/src/libknot/rr.c
index ddf1df7ed3bba174bebae3e8ad2e0f9c5193b748..4b4a6d4dc25323eff91988631aa3bd47aa6ef3ce 100644
--- a/src/libknot/rr.c
+++ b/src/libknot/rr.c
@@ -20,7 +20,6 @@
 #include <stdlib.h>
 
 #include "libknot/rr.h"
-#include "libknot/rdata.h"
 #include "libknot/common.h"
 #include "common/errcode.h"
 
diff --git a/src/libknot/rr.h b/src/libknot/rr.h
index 4fd46b85a6fcb4877447132bd89a6b14ebf5868b..98b54da985847da64b7e292c27672e703777866d 100644
--- a/src/libknot/rr.h
+++ b/src/libknot/rr.h
@@ -206,3 +206,16 @@ int knot_rrs_intersect(const knot_rrs_t *a, const knot_rrs_t *b,
  */
 int knot_rrs_subtract(knot_rrs_t *from, const knot_rrs_t *what,
                       mm_ctx_t *mm);
+
+/*! \brief Accession helpers. */
+#define RRS_CHECK(rrs, pos, code) \
+	if (rrs == NULL || rrs->data == NULL || rrs->rr_count == 0 || \
+	    pos >= rrs->rr_count) { \
+		code; \
+	}
+
+static inline uint8_t *data_offset(const knot_rrs_t *rrs, size_t pos,
+                                   size_t offset) {
+	knot_rr_t *rr = knot_rrs_rr(rrs, pos);
+	return knot_rr_rdata(rr) + offset;
+}
diff --git a/src/libknot/rrset.c b/src/libknot/rrset.c
index 5b79af261db38bf67cd35ae63f0545ac3f4a729e..818f3caea4c09e063f12f7821b8cb84940b7c461 100644
--- a/src/libknot/rrset.c
+++ b/src/libknot/rrset.c
@@ -32,7 +32,6 @@
 #include "libknot/packet/wire.h"
 #include "libknot/packet/pkt.h"
 #include "libknot/dname.h"
-#include "libknot/rdata.h"
 
 static uint16_t rrset_rdata_naptr_bin_chunk_size(const knot_rrset_t *rrset,
                                                size_t pos)
diff --git a/src/libknot/tsig-op.c b/src/libknot/tsig-op.c
index 6ff78c9eb86d5dbd4911b568207942a5143368eb..a340f5a9224e2188ca83e163ebe0dd50a07db786 100644
--- a/src/libknot/tsig-op.c
+++ b/src/libknot/tsig-op.c
@@ -23,7 +23,7 @@
 
 #include "libknot/common.h"
 #include "common/descriptor.h"
-#include "libknot/tsig.h"
+#include "libknot/rdata/tsig.h"
 #include "libknot/tsig-op.h"
 #include "libknot/packet/wire.h"
 #include "common/debug.h"
diff --git a/src/libknot/tsig-op.h b/src/libknot/tsig-op.h
index ce627b5c94f11f17b8f3fc54119108b411896906..535d4e325de7144fb4757567401fcc0adcc70874 100644
--- a/src/libknot/tsig-op.h
+++ b/src/libknot/tsig-op.h
@@ -29,7 +29,7 @@
 
 #include <stdint.h>
 
-#include "libknot/tsig.h"
+#include "libknot/rdata/tsig.h"
 #include "libknot/rrset.h"
 #include "libknot/dnssec/key.h"
 
diff --git a/src/utils/nsec3hash/nsec3hash_main.c b/src/utils/nsec3hash/nsec3hash_main.c
index f7d33d7d61a9cfb4e5d6c7f15ef83d5fcf33bbee..bbd7b793804de2d0917199173f4192c7c2db10dc 100644
--- a/src/utils/nsec3hash/nsec3hash_main.c
+++ b/src/utils/nsec3hash/nsec3hash_main.c
@@ -27,7 +27,6 @@
 #include "common/hex.h"
 #include "common/strtonum.h"
 #include "libknot/dnssec/crypto.h"
-#include "libknot/dnssec/nsec3.h"
 
 #define PROGRAM_NAME "knsec3hash"
 
diff --git a/tests/dnssec_nsec3.c b/tests/dnssec_nsec3.c
index 8db2af9f3ce581343330c766089aeac946b3f685..ed20bdb9d5eb049dff24e570e8b94d3ae7357c7d 100644
--- a/tests/dnssec_nsec3.c
+++ b/tests/dnssec_nsec3.c
@@ -23,8 +23,8 @@
 #include "common/errcode.h"
 #include "libknot/dname.h"
 #include "libknot/consts.h"
-#include "libknot/dnssec/nsec3.h"
 #include "libknot/rrset.h"
+#include "libknot/rdata/nsec3.h"
 
 int main(int argc, char *argv[])
 {
diff --git a/tests/pkt.c b/tests/pkt.c
index 7f6857174a53ef359187cc7e67c79dace26e0b6c..c74eadbe16fdf420ef47043c2811340f176e45eb 100644
--- a/tests/pkt.c
+++ b/tests/pkt.c
@@ -19,9 +19,9 @@
 
 #include "common/errcode.h"
 #include "common/mempool.h"
-#include "libknot/rdata.h"
+#include "common/descriptor.h"
 #include "libknot/packet/pkt.h"
-#include "libknot/tsig.h"
+#include "libknot/rdata/tsig.h"
 
 #define TTL 7200
 #define NAMECOUNT 3