Records

SOA: start of authority

SOA holds a zone's serial number, its primary server, and the timers that drive zone transfer. Exactly one sits at every zone apex.


Type number	6
RFC	1035
RDATA	Primary NS · admin email · serial · refresh · retry · expire · minimum

What it holds#

Seven fields, in this order on the wire:

isitdns.net.  SOA  coleman.ns.cloudflare.com.  dns.cloudflare.com.
              2412230330  10000  2400  604800  1800

isitdns.net is administered from coleman.ns.cloudflare.com; its contact is dns@cloudflare.com (the first dot stands in for the @). The serial is the zone's version counter: it goes up every time anything changes, so the live value will differ from the snapshot above.

Field	Meaning
Primary NS	The "MNAME": the master server. Secondaries refresh from this name.
Admin email	Contact for the zone, encoded with `.` instead of `@` (`dns.cloudflare.com.` encodes `dns@cloudflare.com`). A `.` already in the local part must be escaped: `John.Smith@widget.xx` becomes `John\.Smith.widget.xx` (RFC 1912 section 2.2).
Serial	A 32-bit version number secondaries use to detect changes (RFC 1035 section 3.3.13). Conventional format: `YYYYMMDDNN`.
Refresh	How often secondaries poll the primary for serial changes. Mostly superseded by NOTIFY (RFC 1996).
Retry	If a refresh fails, how long to wait before retrying.
Expire	If the primary stays unreachable, how long before secondaries stop serving stale data.
Minimum	One of the two inputs to how long resolvers cache negative answers (`NXDOMAIN` and NODATA) from this zone: the negative TTL is the lower of this field and the SOA record's own TTL (RFC 2308 section 5). See negative caching and TTL.

When to use it#

Every zone gets exactly one SOA at the apex when the zone is created; managed providers auto-generate it, and in a self-hosted zone file (BIND, NSD) you write it once. Using SOA means reading it:

Serial checks. Ask each authoritative server for the zone's SOA and compare serials: a server whose serial is behind is serving a stale copy.
Transfer debugging. When zone transfer between primary and secondaries breaks, the serial mismatch is the symptom.
Negative-cache tuning. The minimum field is worth editing by hand: a long minimum means NXDOMAIN responses hang around in resolvers long after you add the record. Pull it down before adding records that previously did not exist.

When not to use it#

Not a propagation signal for resolvers. The serial tells secondaries when to transfer; resolver caches expire answers on each record's own TTL (RFC 1035 section 3.2.1) and never consult the serial. Bumping the serial flushes nobody's cache.
Not the zone's default TTL. The minimum field set default TTLs under original RFC 1035; RFC 2308 section 4 redefined it as the negative-cache TTL and gave zone files the $TTL directive for the default instead.
Not a reliable contact address. The admin email is whatever the operator set, and managed zones carry the provider's default (dns@cloudflare.com above), not the zone owner's mailbox.

dig example#

Asks for the record at the top of the isitdns.net zone.

$ dig @1.1.1.1 isitdns.net SOA

; <<>> DiG 9.20.11-0ubuntu0.2-Ubuntu <<>> @1.1.1.1 isitdns.net SOA

; (1 server found)

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5372

;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:

; EDNS: version: 0, flags:; udp: 1232

;; QUESTION SECTION:

;isitdns.net. IN SOA

;; ANSWER SECTION:

isitdns.net. 1800 IN SOA coleman.ns.cloudflare.com. dns.cloudflare.com. 2414897098 10000 2400 604800 1800

;; Query time: 37 msec

;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)

;; WHEN: Mon Sep 14 13:45:34 CDT 2026

;; MSG SIZE rcvd: 105

GO NOERROR and one SOA with the primary server, the contact and five numbers

NO GO SERVFAIL, or, one SOA TTL after you publish, an older serial

run this query in the dig tool →

what each part of this output means →

example.isitdns.net is a set of names inside the isitdns.net zone, not a zone of its own: there is no zone cut, so it has no SOA. The live example is the apex, isitdns.net.

The RFC: SOA is defined in RFC 1035 section 3.3.13. The minimum field was redefined as the negative-cache TTL by RFC 2308 section 4.

Gotchas#

Serial number rollover. SOA serial is a 32-bit unsigned int governed by RFC 1982 serial-number arithmetic: a numerically lower serial is not always the older one, and near a 32-bit wraparound the numerically higher value can be the stale copy. Use YYYYMMDDNN (the RFC 1912 section 2.2 recommendation, good until year 4294) for predictability and you will never hit it. Use a hand-tracked counter and someday you will.
Long minimum bites. A zone with minimum = 86400 (a day) means an NXDOMAIN you cached this morning is still cached when you fix the record this afternoon. Lower it before making schema-style changes; raise it back later. Per RFC 2308 section 5, the actual negative cache TTL used by resolvers is min(minimum, SOA record TTL), so raising minimum above the SOA record's own TTL buys nothing: that TTL is the ceiling.
Multiple SOAs. RFC 1035 section 5.2 says exactly one SOA RR should be present at the top of the zone. Most authoritative servers refuse to create a second. Importing a zone file with two by accident leaves behavior undefined.