SOA What is an SOA Record?
An SOA (Start of Authority) record stores DNS zone metadata: the primary nameserver, admin contact, serial number, and TTL values for zone transfers.
What is an SOA record?
The SOA (Start of Authority) record is a mandatory DNS record that marks the beginning of a zone and stores administrative information about it. Every DNS zone has exactly one SOA record. It tells resolvers which nameserver is the primary authority for the zone, who manages it, and how long records should be cached.
You don't usually configure SOA records manually — your DNS host generates them. But understanding them helps you diagnose propagation delays and zone transfer issues.
Anatomy of an SOA record
example.com. 3600 IN SOA ns1.example.com. admin.example.com. (
2024010101 ; Serial
3600 ; Refresh
900 ; Retry
604800 ; Expire
3600 ) ; Minimum TTL| Field | Value | Description |
|---|---|---|
| Primary NS | ns1.example.com. | The authoritative primary nameserver for this zone. |
| Responsible | admin.example.com. | Zone administrator's email — the first dot replaces the @ symbol. This means admin@example.com. |
| Serial | 2024010101 | Version number of the zone. Must be incremented every time the zone changes so secondary nameservers know to pull updates. |
| Refresh | 3600 | How often (seconds) secondary nameservers check the primary for zone updates. |
| Retry | 900 | How long a secondary waits before retrying a failed refresh. |
| Expire | 604800 | How long (seconds) a secondary continues serving zone data if it can't reach the primary. After this, it stops answering queries. |
| Minimum TTL | 3600 | Default TTL for records in the zone (also used as the negative caching TTL per RFC 2308). |
The serial number convention
The serial is typically formatted as YYYYMMDDNN — the date followed by a two-digit revision number. So 2024010101 means the first change on January 1st 2024.
The only hard rule is that the serial must be a higher number than the previous one (it wraps around at 2³²). If a secondary sees the same or lower serial, it won't request a zone transfer.
Common mistakes
- Forgetting to increment the serial — If you update DNS records but forget to bump the serial, secondary nameservers won't pull the changes. Updates appear to work on the primary but don't propagate.
- Email format confusion — The responsible field uses dots, not @.
hostmaster.example.com.meanshostmaster@example.com. A dot in the local part is escaped as.in zone file notation. - Very short expire values — If the expire time is too short and your primary becomes unreachable, secondary servers stop answering queries. Typical values are 1–4 weeks.
Frequently asked questions
What does SOA stand for?
SOA stands for Start of Authority. It marks the beginning of a DNS zone and stores metadata about it.
Can I have more than one SOA record?
No. Every zone has exactly one SOA record. Multiple SOA records would be invalid.
Why does the responsible email use dots instead of @?
The @ symbol has special meaning in zone file syntax (it refers to the zone origin), so email addresses are written with a dot replacing the @ sign.
What is negative caching TTL?
The minimum TTL in the SOA record also controls how long resolvers cache NXDOMAIN responses (domain not found). Lower values mean negative results expire faster, which is useful when you're creating new records.