What Is SOA Records?

At a glance

A normal DNS zone has an SOA record. Its serial identifies the zone version, while refresh, retry and expire guide secondary synchronization and expiry.

The management starting point for a DNS zone

Start of Authority sits at the zone apex and declares a primary nameserver, administrative contact, serial number and secondary-server timing parameters. It is management and synchronization metadata for authoritative DNS, not a website-content record.

A normal zone has one SOA. Its contact uses DNS-name notation in place of an email address, and the operator or provider maintains the serial. Refresh, retry, expire and negative-caching values influence update checks, retries and how long secondaries can continue serving an outdated zone.

Serial numbers and zone synchronization

• Secondaries periodically query the primary's SOA. When the serial advances, they obtain changes through AXFR, IXFR or provider-specific mechanisms.
• Refresh controls routine checking, retry controls attempts after failure, and expire can stop a secondary serving a zone whose freshness it can no longer establish.
• Serials must advance under DNS serial-number arithmetic. Manual rollback or conflicting node versions can disrupt synchronization.
• Under modern rules the SOA minimum field primarily participates in negative caching. It is not simply a default TTL for every record in the zone.

Diagnosing DNS problems with SOA

Comparing serials across authoritative nodes can reveal incomplete synchronization. Primary-server names may expose migration leftovers. Negative-cache anomalies, transfer delays and inconsistent node answers often need SOA context.

Managed DNS may hide traditional primary-secondary implementation and generate SOA automatically. Differences from a self-managed BIND configuration do not inherently indicate poor settings. Evaluate architecture, change frequency and recovery objectives.

Practical use and interpretation

SOA hostnames, serials and timing values can be reported directly. Naming patterns may suggest a DNS platform. Establishing synchronization requires contemporaneous checks of multiple authorities; one serial cannot prove all nodes agree.

There is no universal high-is-good or low-is-good score. Definite conflicts, expiry or protocol-invalid values support concrete findings. Other values need conditional interpretation in the provider's operating model.

Points to consider

SOA gives management clues, but parameter choices depend on hosting architecture. Higher or lower numbers are not universal quality scores.

Frequently asked questions

Why does the SOA contact lack an @ symbol?

It uses DNS-name notation. The first unescaped dot normally represents the email address's @ separator.

Must an SOA serial use a date?

No. Date-plus-revision is a common manual convention. The protocol requires correct advancement under serial-number arithmetic.

Are different serials across authoritative servers normal?

Brief differences can occur during synchronization. Persistent disagreement warrants investigation of transfers or publishing.