What is a DNS SOA Record?
by
Last Updated: 7 min read
Key Takeaways
- A DNS SOA record is essential for aligning with IETF standards and ensuring successful zone transfers between primary and secondary servers.
- SOA records contain vital information such as the primary name server, the administrator’s email address, and refresh and expire times.
- Proper configuration of the SOA record helps prevent compliance issues and ensures the integrity of DNS zones.
- Zone transfers, facilitated by SOA records, allow content replication across multiple servers, saving time and improving efficiency.
- Utilizing tools to check SOA records can help troubleshoot potential issues and ensure that DNS information is accurate and up to date.
An SOA (Start of Authority) record is the DNS record that stores the core administrative settings for a DNS zone, including its authoritative name server, administrative contact, and timing information for DNS updates. Every DNS zone must have exactly one SOA record.
What Does an SOA Record Do?
SOA record or Start of Authority record is a type of DNS record containing crucial information like the administrator’s email address, refreshing server timeframe, domain updating history, etc. Configuring an SOA record in your respective DNS is important to align with the IETF (Internet and Engineering Task Force) standards.
DNS SOA records are needed for successful zone transfers as you’ve to send them from a primary server to a secondary server.
What is Included in a Typical DNS SOA Record?
A standard DNS SOA record will include the following details:
- Primary name server of a domain.
- Correspondence of the responsible party of a domain.
- A timestamp to capture all the updates made.
- The number of seconds left for zone refreshment.
- The number of seconds left for discarding a failed refresh.
- The upper limit in seconds before a zone is labeled as inauthoritative.
- The negative result TTL or Time-to-Live. TTL is the amount of time that a packet or data survives for.
SOA Record Example
A typical SOA record may look like this:
None
example.com. IN SOA ns1.example.com. admin.example.com. (
2026081201 ; Serial Number
3600 ; Refresh
900 ; Retry
1209600 ; Expire
86400 ; Default TTL
) Each value tells DNS servers something different about how the zone should be managed:
- Primary name server: ns1.example.com. identifies the authoritative primary name server for the zone.
- DNS admin email: admin.example.com. represents the administrator responsible for the DNS zone. In an SOA record, the first dot normally represents the @ symbol.
- Serial number: 2026081201 identifies the current version of the zone. Secondary DNS servers use it to determine whether they need to retrieve an updated copy.
- Refresh: 3600 seconds tells secondary servers how often to check whether the zone has changed.
- Retry: 900 seconds specifies how long secondary servers wait before retrying if a zone transfer fails.
- Expire: 1209600 seconds determines how long a secondary server can continue serving the zone if it cannot reach the primary server.
- Default TTL: 86400 seconds specifies the default time DNS records can be cached when no specific TTL is provided.
You may also see an SOA record when using a command such as dig:
None
$ dig SOA example.com
example.com. 3600 IN SOA ns1.example.com. admin.example.com.
2026081201 3600 900 1209600 86400 The values and formatting can vary between DNS providers, but the seven SOA fields remain the same.
SOA Record Structure: The 7 Fields Explained
An SOA record contains seven key fields. Together, they control how DNS servers identify the authoritative source for a zone and synchronize changes between primary and secondary servers.
| Field | What it does | Typical value |
|---|---|---|
| Serial Number | Identifies the current version of the DNS zone | 2026081201 |
| Primary Name Server | Identifies the primary authoritative name server | ns1.example.com. |
| DNS Admin Email | Identifies the DNS administrator | admin.example.com. |
| Refresh Rate | Determines how often secondary servers check for updates | 3600 |
| Retry Rate | Determines how often failed update checks are retried | 900 |
| Expire Time | Determines how long secondary servers can serve the zone without contact with the primary | 1209600 |
| Default TTL | Sets the default caching period for DNS records | 86400 |
Serial Number
It’s the revision number of a zone file, which changes every time a file changes. This value should be changed so that changes made will be distributed across all DNS servers. In most systems, this process is automatic.
Primary Name Server
As the name says, it’s the primary DNS server of a zone. It changes back to the default one if you enter an invalid primary name server.
DNS Admin Email
It’s the email address of the person responsible for administering particular DNS and zone files. If you enter the wrong email address, it changes back to the default one.
Refresh Rate
Refresh rate is the time in seconds for which a secondary server waits before querying the primary DNS SOA record for updates. The refresh rate varies from 1200 to 43,200 seconds.
Retry Rate
Retry rate is the time in seconds for which a secondary server waits before retrying a failed zone transfer. Typically, the refresh rate is more than the retry rate, and the default rate is 1800 seconds. However, it can vary between 180 and 2,419,200 seconds.
Expire Time
It’s the time in seconds that a secondary server tries to finish a zone transfer. If this time expires before the completion of a zone transfer, its zone files will also be expired. The secondary server won’t respond to queries as it perceives the data to be old. The default expiration time is 1,209,600 seconds.
Default TTL
TTL stands for Time-to-Live, which is the time period for which a packet or data lives for. Other servers use this value to know how long they should keep the data in the cache. The default value is 3,600 seconds or 1 hour.
Why Do You Need an SOA Record? (Is It Mandatory?)
A DNS SOA record holds details about your zone. DNS name servers are usually set up in clusters, and the database is synchronized using internal zone transfers. Any zone without an SOA record fails to comply with IETF’s protocols, and zone transfer isn’t possible. Thus IT-driven business owners must know what is a DNS SOA record.
Every DNS zone requires exactly one SOA record. A zone without a valid SOA record does not meet the basic requirements for a properly functioning DNS zone and may not resolve reliably.
How Do SOA Records Work?
DNS is a decentralized system working as per a hierarchy. So, name servers supply information to the servers dedicated to a particular zone by administering all the zone files. These are simple text files containing details regarding all the DNS records. These records offer information on the number of issues, like if the right server has been requested to resolute a responsibility or not.
DNS SOA records are necessary for server clusters as they distribute requests among devices. This averts the overloading of a specific server that may lead to system failure.
A zone transfer must be performed regularly for zone files to remain active on all the involved servers. However, slaves (servers situated lower on the hierarchy) must be contemporized with the master server (the single host in a particular domain that maintains the authoritative maps).
It directs how a zone transfer should be carried out and regulated. Thus, a DNS SOA record receives all types of information.
What Is Zone Transfer in DNS?
To understand how SOA records work, you must know what zone transfer is in DNS.
Zone transfer is the process of replicating any zone’s content on a primary server across DNS servers. This eliminates the need to edit information on multiple servers. So, you can edit information on the main server and copy it to others, saving time and effort.
How to Check Your SOA Record
You can use special tools or web services to check your website’s DNS SOA record. All you need to do is enter a relevant domain, and the following page will display the ‘A’ record. You can select ‘SOA’ in the appropriate field to check records.
Public DNS allows you even to establish additional efficient connections with DNS; however, only limited resources offer this. The information received via DNS flows from the originator, and the security protocols can’t be manipulated theoretically.
This type of SOA record check request is performed using the ‘Question and Answer’ format. You can seek the master server, the admin’s email address, and the time specifications.
You can verify your SOA record using our SOA record lookup tool when you sign up on the PowerDMARC platform. The process is instantaneous and accurate, with results that highlight errors in your record, helping you troubleshoot issues faster!
You can also check an SOA record directly from the command line using dig or nslookup.
None dig SOA yourdomain.com
Or:
None nslookup -type=SOA yourdomain.com
The output will show the authoritative name server, administrative contact, serial number, refresh interval, retry interval, expire interval, and default TTL for the domain.
For a simpler way to inspect DNS information, you can also use PowerDMARC’s SPF record lookup.
SOA Records and Email Authentication
Your SOA record does not authenticate email itself, but it belongs to the DNS zone that also contains your SPF, DKIM, and DMARC records. Changes to these authentication records therefore depend on the health and behavior of the DNS zone in which they are published.
The SOA record also contains timing information used by DNS servers, particularly for zone transfers and synchronization. This is separate from the TTL configured on individual SPF, DKIM, or DMARC records, which controls how long those records may be cached.
Understanding the SOA record can therefore help when troubleshooting DNS changes that affect email authentication. For more information, see our guides on SPF records and DMARC records.
Frequently Asked Questions
What does an SOA record do?
An SOA record stores the core administrative information for a DNS zone, including its primary name server, administrator contact, serial number, and timing values. It also helps secondary DNS servers determine when they need to synchronize zone changes.
Is an SOA record mandatory?
Yes. Every DNS zone must have exactly one SOA record as part of its authoritative DNS information. Without a valid SOA record, the zone is not properly configured and may not resolve reliably.
Can you provide an example of an SOA record?
Yes. A typical SOA record contains the primary name server, administrator email, serial number, refresh, retry, expire, and default TTL values. You can see a complete example in the SOA Record Example section above.
How do I find my SOA record?
You can use dig SOA yourdomain.com or nslookup -type=SOA yourdomain.com from the command line to retrieve it. You can also use an online SOA lookup tool to inspect the record without running command-line queries.
What happens if the SOA serial number isn’t updated?
Secondary DNS servers use the SOA serial number to determine whether the zone has changed. If the serial number is not incremented after a zone change, secondary servers may continue using an older version of the zone instead of transferring the updated data.
How does the SOA record affect SPF, DKIM, and DMARC propagation?
The SOA record helps define how a DNS zone is managed and synchronized, while the TTL on individual SPF, DKIM, and DMARC records controls their caching. Changes to email authentication records may therefore take time to appear consistently across DNS resolvers depending on their TTL and the DNS infrastructure involved.
Final Thoughts
DNS SOA record contains sensitive information like an administrator’s email address, server refreshing timeframe, domain update history, etc. These records help in zone transfer, the process of copying any zone’s content across all the secondary DNS servers. This saves time and effort in manually replicating content. SOA records distribute requests among various servers to avoid congestion and breakdown.
Infotech-driven businesses must comply with a DMARC policy that works based on SPF and DKIM protocols. You’ve to publish a DMARC record in the DNS to instruct recipients’ mailboxes on how to deal with your emails per the policies set. You can use the DMARC analyzer to gain insights on several issues related to it.
Domain & Email Security Expert at PowerDMARC
Ahona is the Marketing Manager at PowerDMARC, with 5+ years of experience in writing about cybersecurity topics, specializing in domain and email security. Ahona holds a post-graduation degree in Journalism and Communications, solidifying her career in the security sector since 2019.
Latest posts by Ahona Rudra (see all)
