Glossary

SOA Record

Contains authoritative information about a DNS zone

An SOA record (Start of Authority record) is a mandatory DNS record that marks the beginning of a DNS zone and contains essential administrative information including the primary name server, the responsible administrator's email, and serial number for tracking zone changes.

What is an SOA Record?

An SOA record, short for Start of Authority record, is a required DNS record that every DNS zone must have exactly one of. It appears at the top of a zone file and acts as the authoritative declaration of control over that zone. The SOA record identifies the primary name server for the zone, provides a contact email address for the zone administrator, and includes timing parameters that control how secondary name servers synchronize with the primary.

The SOA record contains seven key fields: MNAME (the primary name server), RNAME (the administrator's email with the @ replaced by a dot), SERIAL (a version number that increments with each zone change), REFRESH (how often secondary servers check for updates), RETRY (how long to wait before retrying a failed refresh), EXPIRE (how long secondary servers will serve zone data if the primary is unreachable), and MINIMUM TTL (the minimum TTL applied to negative responses).

Though end users rarely interact with SOA records directly, they are critical for DNS zone management, secondary server synchronization, and DNSSEC operation.

How Does an SOA Record Work?

The SOA record drives the zone transfer mechanism between primary and secondary (slave) name servers. Secondary servers periodically poll the primary server and compare the SERIAL number in the SOA record with their own copy. If the primary's serial number is higher, the secondary initiates a zone transfer (AXFR or IXFR) to pull the updated records. This is how DNS changes made on the primary server propagate to all secondary servers.

The REFRESH, RETRY, and EXPIRE values control the timing of this synchronization. A typical configuration might use a REFRESH of 3600 seconds (one hour), meaning secondary servers check for updates hourly. If a check fails, the server retries after RETRY seconds. If the primary remains unreachable for EXPIRE seconds (commonly one to two weeks), secondary servers stop serving the zone to prevent serving stale data.

For DNS providers using anycast and automated infrastructure, the zone transfer model is largely invisible to customers. However, the SOA record's serial number remains important — many DNS management systems require the serial to be incremented whenever a zone change is saved, or the change may not propagate correctly.

How to Check an SOA Record

You can inspect the SOA record for any domain using the SOA Lookup tool at nslookup.net/tools/soa-lookup. The tool queries the authoritative name servers and returns all fields of the SOA record, including the serial number, refresh interval, and responsible administrator contact. Checking the SOA record is useful when diagnosing zone transfer issues, verifying that a DNS change was saved correctly, or investigating the history of a domain's DNS management.

Related Tool

SOA Lookup

Try the Tool →

Frequently Asked Questions

What is the serial number in an SOA record?

The serial number is a 32-bit integer that acts as a version counter for the DNS zone. Every time records in the zone are changed, the serial number should be incremented. Secondary name servers compare their serial with the primary's; if the primary's is higher, they initiate a zone transfer to get the latest records. A common convention is to use the date in YYYYMMDDNN format, such as 2025062701.

Can a zone have more than one SOA record?

No. DNS requires exactly one SOA record per zone, and it must be at the zone apex (the root of the zone). Having zero or multiple SOA records is a zone file error that will prevent the zone from loading correctly on authoritative name servers.

What does the RNAME field in the SOA record mean?

RNAME stands for Responsible Name and contains the email address of the DNS zone administrator, but with the @ symbol replaced by a dot. For example, admin@example.com would be written as admin.example.com in the RNAME field. This allows the email address to be stored as a valid DNS name. The trailing dot in a fully qualified RNAME indicates it is absolute.

What is the minimum TTL in an SOA record?

The minimum TTL value in the SOA record (the last field) originally set the minimum TTL for all records in the zone, but its modern usage (per RFC 2308) is to define the negative caching TTL — how long resolvers should cache a "this record does not exist" (NXDOMAIN) response. Keeping this value reasonably low (300 to 900 seconds) helps ensure that newly added records become visible more quickly.