An SOA (Start of Authority) record is a mandatory DNS resource record that must exist at the apex of every DNS zone. It designates the primary authoritative nameserver and contains critical parameters for zone administration and replication.
Every SOA record contains seven fields:
| Field | Purpose |
|---|---|
| MNAME | Primary nameserver hostname |
| RNAME | Administrator email (with dots replacing @, e.g., admin.example.com for [email protected]) |
| SERIAL | 32-bit version number; secondaries use this to detect zone updates |
| REFRESH | Seconds before secondary checks primary for updates |
| RETRY | Seconds to wait before retrying a failed refresh |
| EXPIRE | Seconds until secondary stops serving data if unreachable |
| MINIMUM | Negative-caching TTL (how long NXDOMAIN/NODATA responses are cached) |
How it works
Secondary (slave) nameservers periodically compare their cached SERIAL against the primary's; a higher SERIAL triggers a zone transfer. The primary can also use NOTIFY to immediately alert secondaries of changes instead of waiting for the REFRESH interval. Resolvers cache negative responses (domain not found) using the MINIMUM value, not the record's own TTL.
Example
example.com. 3600 IN SOA ns1.example.com. admin.example.com. (
2024010101 ; SERIAL
86400 ; REFRESH (1 day)
3600 ; RETRY (1 hour)
2592000 ; EXPIRE (30 days)
3600 ) ; MINIMUM (1 hour, negative cache TTL)
TipEvery zone must have exactly one SOA record at the apex. The MINIMUM field (per RFC 2308) controls how long resolvers cache "not found" responses, separate from the record's own TTL.