SOA (Start of Authority) is the first and most privileged record in every DNS zone. It defines who owns the zone, when it was last modified, and how secondary nameservers should behave.
Record Format
example.com. SOA ns1.example.com. admin.example.com. (
2026091101 ; serial
3600 ; refresh
600 ; retry
604800 ; expire
3600 ; minimum (negative TTL)
)Fields
| Field | Purpose |
|---|---|
| Primary NS | The authoritative source of the zone |
| Admin email | Contact for zone ops (dots replace @) |
| Serial | Version number, bumped on every change |
| Refresh | How often secondaries poll the primary |
| Retry | Retry interval after a failed refresh |
| Expire | How long secondaries serve stale data if primary is unreachable |
| Minimum | Negative-cache TTL — how long NXDOMAIN answers are cached |
Common Gotchas
- Forgetting to bump the serial means secondary nameservers never update.
- Setting minimum too high caches NXDOMAIN across resolvers for days, breaking newly-created subdomains.
- Admin email uses the DNS convention:
admin.example.com.means[email protected].
Related
Read what an SOA record is in depth, check the TTL glossary entry, and the nameserver definition.