SOA
Start of Authority
The SOA record is the administrative record at the top of every DNS zone. Learn what each field means and why the serial number matters.
Published · Last verified · Maintained by TamingDNS
SOA
Zone Management
RFC 1035
Indirect
SOA <primary-ns> <admin-email> <serial> <refresh> <retry> <expire> <minimum>
SOA ns1.example.com. admin.example.com. 2024010101 3600 900 604800 300
SOA TTL itself is typically 3600 s; the minimum field controls negative caching (300-900 s recommended)
💬 What This Record Does
Every DNS zone has exactly one SOA (Start of Authority) record. It identifies the primary nameserver for the zone, provides the administrator's contact email (with "@" replaced by "."), and contains timing values used by secondary nameservers. The serial number is incremented each time the zone changes. Secondary nameservers compare their serial to the primary's; if the primary is higher, they fetch an updated zone. The minimum TTL field controls how long resolvers cache negative answers ("this record does not exist").
Common Uses
- Diagnosing zone transfer problems between primary and secondary nameservers
- Checking whether a zone update has propagated (serial number verification)
- Tuning negative caching with the minimum TTL field
⚠️ Watch Out For
- Most DNS providers manage the SOA automatically. Editing it manually can break zone transfers.
- If your serial doesn't increment on each change, secondary nameservers won't pick up updates.
- A very high minimum TTL (negative caching) means resolvers cache "record not found" for a long time, slowing propagation of new records.
🔧 Related Tools
📋 Complete Example Records
Whole records in zone-file form: name, TTL, class, type, then the data. Most DNS panels ask for the pieces separately. Look them up live with the DNS Lookup tool.
example.com. 3600 IN SOA ns1.example.com. hostmaster.example.com. (
2026080601 ; serial
3600 ; refresh
900 ; retry
604800 ; expire
300 ) ; minimum
A full SOA with each field named. The second value is an email address with the @ written as a dot, so hostmaster@example.com becomes hostmaster.example.com.
example.com. 3600 IN SOA ns1.example.com. hostmaster.example.com. 2026080601 3600 900 604800 300
The same record on one line, which is how most panels and dig output show it.
example.com. 3600 IN SOA ns1.example.com. hostmaster.example.com. 2026080602 3600 900 604800 300
The same zone after an edit, with the serial bumped. Secondary servers compare serials to decide whether to pull a fresh copy, so a forgotten bump leaves them serving the old data.
example.com. 3600 IN SOA ns1.example.com. hostmaster.example.com. 2026080601 3600 900 604800 3600
The last field raised to an hour. It sets how long a negative answer is cached, so a high value means a newly added record stays missing for longer.