DNS record types

What is a SOA record?

The SOA record marks the top of a DNS zone and holds the settings that govern how the zone is copied between nameservers and how long negative answers are cached.

Every DNS zone has exactly one SOA record, and it sits at the zone apex — the bare domain, not a subdomain. Its job is administrative rather than navigational: no visitor's browser ever follows it. It tells the other nameservers serving the zone how to stay in step with the primary, and it tells every resolver on the internet how long to remember that a name does not exist.

It is created automatically when you add a domain to a DNS host, which is why most people never touch one and then meet it in an error message. When a tool reports an SOA problem it almost always means the delegation points at nameservers that are not actually serving the zone.

The fields

MNAME: The primary nameserver for the zone — the one that holds the master copy and that secondaries pull from.
RNAME: The administrator's email address, written with the @ replaced by a dot. admin@example.com becomes admin.example.com.
SERIAL: A version number for the zone. It must increase every time the zone changes, because secondaries decide whether to copy the zone by comparing serials. Convention is YYYYMMDDnn.
REFRESH: How often a secondary checks the primary for a new serial, in seconds.
RETRY: How long a secondary waits before trying again after a failed check.
EXPIRE: How long a secondary keeps answering when it cannot reach the primary at all. Past this it stops serving the zone entirely.
MINIMUM: Now used as the negative caching TTL: how long resolvers remember that a name does NOT exist. This is the field that makes a typo take hours to disappear.

Example

example.com. 3600 IN SOA ns1.example.com. admin.example.com. (
  2026090101 ; serial
  7200       ; refresh
  3600       ; retry
  1209600    ; expire
  3600 )     ; minimum — negative cache TTL

The mistake people make

The MINIMUM field is the one that catches people. It no longer means a default TTL for the zone; since RFC 2308 it sets how long the internet caches the fact that a name does not exist. Set it to 86400 and a mistyped record you fix in a minute will keep returning NXDOMAIN for a day.

Check the SOA records on a real domain, with everything else that can quietly break.

Check a domain