BRev SOA record — start of authority
Every zone has exactly one SOA record, at its apex, and it defines the zone’s existence. It names the primary nameserver and the responsible party’s email — written as a domain name, so the @ becomes a dot: hostmaster.example.com means hostmaster@example.com, and an address with a dot in the local part escapes it as a backslash.
The five numbers after that govern how secondary nameservers replicate the zone. Serial is a version number the secondaries compare; refresh is how often they check; retry is how soon to try again after a failed check; expire is how long a secondary keeps serving stale data before giving up entirely and answering SERVFAIL. Getting expire wrong is the one with teeth — too short and a transient primary outage takes the whole zone offline.
The fifth number has changed meaning. It was once the default TTL for records without one; RFC 2308 redefined it as the negative caching TTL — how long resolvers remember that a name does not exist. That is why a freshly created record sometimes stays NXDOMAIN for a while after you add it: something asked for it before it existed, and the negative answer is cached for this value. Keeping it modest (a few minutes to an hour) makes new records appear promptly.
What a SOA record looks like
Type 6 · Start of authority (serial, refresh, retry, expire, minimum). Zone-file form below — owner name, TTL, then the record and its RDATA.
| Name | TTL | Record | What it means |
|---|---|---|---|
| example.com. | 3600 | SOA ns1.example-dns.net. hostmaster.example.com. 2026072901 7200 3600 1209600 300 | The whole record: primary, responsible party, then serial refresh retry expire minimum. |
| (serial) | — | 2026072901 | YYYYMMDDnn is the convention: 29 July 2026, first change of the day. Must increase on every edit. |
| (refresh / retry) | — | 7200 / 3600 | Secondaries check every 2 hours; after a failed check they retry every hour. |
| (expire / minimum) | — | 1209600 / 300 | A secondary serves stale data for at most 14 days. NXDOMAIN answers are cached for 300 seconds. |
The mistakes that break production
A serial that did not increase
Secondaries only transfer when the serial is higher than the copy they hold, so an edit without a serial bump propagates to none of them — the primary answers correctly and the secondaries serve yesterday’s zone. Worse, a serial accidentally set far into the future cannot be lowered normally; recovery uses the RFC 1982 wrap-around procedure or a rebuild.
A new record that keeps returning NXDOMAIN
Negative caching. Something queried the name before it existed, and resolvers cache that non-existence for the SOA minimum. Wait it out — there is no way to flush a third-party resolver — and lower the minimum if this happens often during development.
Query a SOA record now
The box below is seeded with example.com. Choose SOA as the type and press Look up — the query goes from your browser straight to Cloudflare or Google over DNS-over-HTTPS, with no server of ours in the path.
DNS is the internet's address book: it turns a name like example.com into the addresses and service endpoints machines actually connect to. Every record has a type (what kind of fact it states) and a TTL (how long resolvers may cache it).
Record types
| Type | What it stores |
|---|---|
| A | IPv4 address |
| AAAA | IPv6 address |
| CNAME | Canonical name (alias) |
| MX | Mail exchanger (priority target) |
| TXT | Text — SPF, verifications, DKIM, arbitrary data |
| NS | Authoritative nameservers |
| SOA | Start of authority (serial, refresh, retry, expire, minimum) |
| SRV | Service locator (priority weight port target) |
| CAA | Which CAs may issue certificates |
| PTR | Reverse DNS (IP → name) |
| DNSKEY | DNSSEC public key |
| DS | Delegation signer (DNSSEC chain of trust) |
| HTTPS | HTTPS service binding (ALPN, ECH, hints) |
| SVCB | General service binding |
| TLSA | DANE — pin certificates in DNS |
| NAPTR | Name authority pointer (SIP/ENUM) |
TTL & “propagation”
DNS changes don't “push” anywhere — resolvers simply keep the old answer until its TTL runs out, then fetch the new one. So a change “propagates” in at most the old record's TTL. Planning a change? Lower the TTL (e.g. to 300s) a day in advance, make the change, then raise it back. The compare card above shows whether major public caches have picked your change up yet.
FAQ
What do the five numbers in an SOA record mean?
Serial (zone version), refresh (how often secondaries check), retry (how soon after a failed check), expire (how long a secondary serves stale data before failing), and minimum (how long resolvers cache a “does not exist” answer).
Why is the email address written with a dot?
The field is a domain name, which has no @. hostmaster.example.com means hostmaster@example.com. A dot inside the local part is escaped with a backslash, which is why the convention is to use a simple role address.
Does the SOA serial affect visitors?
Not directly — it drives zone transfers between your own nameservers. It matters to visitors only when it stops secondaries updating, at which point some of them serve an outdated zone.