SOA DNS Record

What the SOA record does

SOA is the zone’s control block. Its most operationally significant field is the serial: secondaries poll the primary, compare serials, and only pull a new copy when the number has increased. Get that wrong and replication silently stops.

Its second most significant field is the last one, historically called minimum, which today means the TTL for negative answers. If you query a name that does not exist, the resolver caches that NXDOMAIN for this long. A generous value here is why a freshly-created record sometimes appears not to exist for far longer than its own TTL would suggest.

Zone-file and wire format

The RDATA is two domain names followed by five 32-bit integers: primary nameserver, responsible-party mailbox (with the @ written as a dot), serial, refresh, retry, expire, and minimum. Serials are conventionally written as YYYYMMDDnn because it is human-readable and monotonic, but any increasing 32-bit number works. Comparison uses the sequence-space arithmetic of RFC 1982, so a serial that jumps backwards is treated as far in the future and transfers stall.

example.com.  86400  IN  SOA  ns1.provider.net. hostmaster.example.com. (
        2026072701  ; serial   — must increase on every change
        7200        ; refresh  — how often secondaries poll
        3600        ; retry    — wait after a failed poll
        1209600     ; expire   — stop answering if the primary stays unreachable
        300 )       ; minimum  — how long NXDOMAIN is cached

Common uses

Day to day you read the SOA rather than write it. Querying every nameserver for the SOA serial is the fastest way to confirm a change has propagated through a set of secondaries — if the serials match and include your edit, the zone is consistent. The record is also where monitoring finds the administrative contact, and where DNSSEC signers and IXFR implementations get the version they are working from. Lowering the minimum field before a launch is a cheap way to avoid the “record exists but nothing can see it” class of incident.

Troubleshooting

Two symptoms map straight to SOA fields. Secondaries serving old data means the serial did not increase, or increased on a server that is not the one they are transferring from. A new hostname that stubbornly refuses to resolve for everyone except you means an NXDOMAIN is cached, and the minimum field tells you how long you have to wait.

Compare serials across all authoritative servers first; it is one query per server and it either proves or eliminates a replication problem in seconds.

# serial on every authoritative server — they should match
for ns in $(dig +short example.com NS); do
  printf '%s -> ' "$ns"
  dig +short @"$ns" example.com SOA | awk '{print $3}'
done

# read the negative-cache TTL (last field) before debugging "missing" records
dig example.com SOA +noall +answer

# an NXDOMAIN response carries the SOA that governs how long it is cached
dig doesnotexist.example.com A +noall +authority

The defining RFC

SOA is type 6, defined in RFC 1035 §3.3.13. The redefinition of the minimum field as the negative-caching TTL is RFC 2308 §4, which is the section to read if you care about how long NXDOMAIN sticks. Serial-number comparison arithmetic is RFC 1982, and common SOA misconfigurations are catalogued in RFC 1912 §2.2. Query a zone’s SOA with the DNS lookup tool.

Reference and tooling

Every record type and its assigned numeric value is listed in theIANA DNS Parameters registry. To query a live zone from the browser, use theDNS lookup tool. If the record you are chasing is TLS-related, the TLS inspector andCertificate Transparency lookup are usually the next two stops.

SOA record

Zone-file example