SOA Record

The SOA (Start of Authority) record is a mandatory record at the apex of every DNS zone. It identifies the primary nameserver, the responsible administrator's contact address, and a set of timing parameters that govern zone transfers and negative caching.

The Fields of an SOA Record

An SOA record in zone file format looks like this:

example.com.  3600  IN  SOA  ns1.example.com.  hostmaster.example.com. (
                2024010101  ; Serial
                3600        ; Refresh
                900         ; Retry
                604800      ; Expire
                300 )       ; Minimum TTL

• MNAME — the primary (master) nameserver for the zone. Secondary nameservers use this to know where to request zone transfers.
• RNAME — the email address of the zone administrator, written with the first @ replaced by a dot. hostmaster.example.com. means hostmaster@example.com.
• Serial — a version counter for the zone. When the serial increases, secondary nameservers know the zone has changed and initiate a transfer. A common convention is the date in YYYYMMDDNN format (where NN is a two-digit change counter for that day), but the only hard requirement is that it increases monotonically.
• Refresh — how often (in seconds) secondary nameservers should check the primary for zone changes by comparing serials.
• Retry — how long a secondary should wait before retrying a failed refresh attempt.
• Expire — how long a secondary can continue to serve zone data without successfully refreshing from the primary before it stops answering queries for the zone entirely.
• Minimum TTL — serves a dual purpose. Historically it set a floor on record TTLs; today (per RFC 2308) it defines the negative caching TTL — how long resolvers cache NXDOMAIN and NODATA responses for this zone.

Serial Number Conventions

The serial number is a 32-bit unsigned integer. The most common format is date-based — for example, 2024010101 for the first change on January 1, 2024. This makes it easy to see at a glance when the zone was last updated. Some systems use a simple incrementing integer instead.

The critical rule is that the serial must increase whenever the zone changes. Secondary nameservers compare the current serial to what they have cached; if the serial has not increased, they assume the zone has not changed and skip the transfer. Forgetting to increment the serial when editing a zone file is a common mistake that causes secondaries to serve stale data.

Serial number comparison uses sequence space arithmetic (RFC 1982) to handle wraparound when the 32-bit maximum is reached.

Negative Caching and the Minimum TTL Field

When a resolver queries for a name that does not exist in a zone, the authoritative server returns an NXDOMAIN response. Resolvers cache this negative answer so they do not need to query the authoritative server again for the same nonexistent name on every subsequent request. The duration of this cache is controlled by the SOA Minimum TTL field (capped at the SOA record's own TTL, whichever is lower).

Setting the Minimum TTL too high means that if you add a record for a previously nonexistent name, clients that already received an NXDOMAIN response will continue to receive the cached negative answer until the negative TTL expires — even though the record now exists. A value in the range of 300 to 3600 seconds is common for most zones.

View SOA records with the DNS tool →