Skip to content
Webmaster Tools
DNS & domainsDNS LookupSOA record

SOA record

What the DNS SOA record is, what MNAME, RNAME, serial, refresh, retry, expire and minimum mean, sensible values, and how to read a zone's SOA with dig.

What it is

The SOA (Start of Authority) record sits at the top of every DNS zone and describes the zone itself: which server is the primary, who runs it, a version number, and timers that secondary servers and resolvers use. Every zone has exactly one, at its apex. It's defined in RFC 1035, and RFC 2308 redefined its last field as the negative-caching TTL.

example.com.  3600  IN  SOA  ns1.example.com. hostmaster.example.com. (
              2026100501 ; serial
              7200       ; refresh
              3600       ; retry
              1209600    ; expire
              3600 )     ; minimum (negative-caching TTL)

The fields

Field Meaning
MNAME The primary name server for the zone (ns1.example.com.)
RNAME The admin mailbox, with the first . standing for @: hostmaster.example.com. is hostmaster@example.com
Serial Zone version. Secondaries transfer the zone only when it increases. YYYYMMDDnn is the usual convention
Refresh Seconds between a secondary's checks of the primary's serial
Retry Seconds to wait before retrying after a failed refresh
Expire Seconds after which a secondary that can't reach the primary stops answering for the zone
Minimum Since RFC 2308: how long resolvers cache "this name doesn't exist" (NXDOMAIN) and "no record of this type" answers

The negative-caching TTL is actually the lower of the SOA record's own TTL and the minimum field. RFC 1912 suggests roughly 1-3 hours for refresh, a smaller retry, and 2-4 weeks for expire. With NOTIFY (RFC 1996), which every modern server sends, refresh is only a fallback: secondaries hear about changes within seconds.

Common setups

Managed DNS providers write the SOA for you. Cloudflare, Route 53, Google Cloud DNS and most registrar DNS show it read-only or let you edit only a few timers; Route 53's default negative-caching value is 86400 seconds (a day), Cloudflare's is 1800. The serial on these services is often a timestamp or a counter they manage. You only maintain the SOA by hand when you run your own BIND, Knot, NSD or PowerDNS servers.

How to check it

Our DNS Lookup can't query SOA records, so use dig:

dig example.com SOA +short
dig example.com SOA +multiline
dig @ns2.example.com example.com SOA +short

Compare the serial from each of the domain's name servers (see dig example.com NS +short): a secondary showing an older serial hasn't picked up the latest change. On Windows: nslookup -type=SOA example.com. Asking for a name that doesn't exist also returns the SOA in the authority section, which is how resolvers learn the negative TTL.

Common mistakes

  • Editing a self-hosted zone without raising the serial, so secondaries keep serving the old data.
  • Setting the serial to a lower number (for example switching from a date to a counter): secondaries ignore it until it wraps or the zone is retransferred.
  • An RNAME with a real @ or an unescaped dot in the local part.
  • A very high minimum: a record queried before you created it keeps answering "doesn't exist" for that long. See DNS propagation.
  • NS record: the servers that hold the zone the SOA describes.
  • DNS TTL: positive caching, the counterpart of the minimum field.
  • CAA record: another apex record our lookup can't query.
  • DNS propagation: why changes and new names take time to appear.