SOA record
Every DNS zone has exactly one SOA (start of authority) record, at its root. It names the primary nameserver and a contact address, carries the zone's version number, and sets the timers that secondary servers and resolvers follow, including how long a "this doesn't exist" answer is cached. Your DNS host manages it for you.
| Record type | SOA |
|---|---|
| Type number | 6 |
| Used for | Delegation |
| How common | Common |
| Defined in | RFC 1035, RFC 2308 |
Format
@ <ttl> IN SOA <primary ns> <contact> <serial> <refresh> <retry> <expire> <minimum>
| Field | What it means | Accepted values |
|---|---|---|
| Primary nameserver (MNAME) | The main server for the zone. | A host name. |
| Contact (RNAME) | The admin's email address, with the @ written as a dot. | hostmaster.example.com. means hostmaster@example.com. Dots before the @ are escaped: john\.doe.example.com. |
| Serial | The zone's version. Secondary servers copy the zone when it goes up. | 0 to 4294967295. Often YYYYMMDDnn, such as 2026102401. |
| Refresh | How often secondaries check the serial. | Seconds; 3600 to 86400. |
| Retry | How soon secondaries retry after a failed check. | Seconds; shorter than refresh. |
| Expire | How long secondaries keep answering if they can't reach the primary. | Seconds; one to four weeks. |
| Minimum | Since RFC 2308: how long resolvers cache "no such name" and "no such record" answers. | Seconds; 300 to 3600 is sensible. |
Check an SOA record
Type or paste a record in zone-file form (name, TTL, type, value) or just its value. Each part is explained as you type.
A valid SOA record.
| Part | What it means |
|---|---|
| Name@ | @ means the domain itself (the root, or apex), such as example.com. |
| TTL3600 | Resolvers may keep this answer for 1 hour before asking again. Changes can take that long to reach everyone. |
| ClassIN | Internet. Every record you'll write uses IN. |
| TypeSOA | Start of authority for a zone. |
| Primary nameserverns1.example.com. | The main nameserver for the zone (MNAME). Often just one of the NS records. |
| Contact emailhostmaster.example.com. | The zone's admin contact (RNAME), read as hostmaster@example.com. The first dot stands for @. |
| Serial2026102401 | Version number of the zone, here in the date format 2026-10-24, change 01. Must go up on every change so secondary servers copy it. |
| Refresh7200 | Secondary servers check for a new serial every 2 hours. |
| Retry3600 | If that check fails, they try again after 1 hour. |
| Expire1209600 | If they can't reach the primary for 2 weeks, they stop answering for the zone. |
| Minimum (negative TTL)300 | How long resolvers remember that a name or record doesn't exist: 5 minutes. Keep it short (5 minutes to 1 hour) so new records show up quickly. |
Examples
A typical SOA
@ 3600 IN SOA ns1.example.com. hostmaster.example.com. 2026102401 7200 3600 1209600 300
Secondaries check every 2 hours, retry after 1 hour, give up after 2 weeks; missing names are cached for 5 minutes.
Cloudflare's style
example.com. 1800 IN SOA ada.ns.cloudflare.com. dns.cloudflare.com. 2353104512 10000 2400 604800 1800
Managed hosts pick their own values and bump the serial on every change.
Why the minimum field matters to you
If someone looks up a record before you create it, resolvers remember that it didn't exist for the SOA's minimum value (or the SOA's own TTL, if lower). A long value is why a brand-new subdomain can seem to take ages to appear for some people. Hosts that let you edit the SOA should keep it at an hour or less.
See it on a real domain
TTL
Set by your DNS host, usually 1800 to 3600. How TTL works
Common mistakes
- Writing the contact as an email with @.
- Editing the zone on a self-run primary without raising the serial, so secondaries never pick up the change.
- Setting the serial in the future (or overflowing it), which needs a careful reset.
- A negative caching (minimum) value of a day or more.
At your DNS host
- Cloudflare, Route 53 and most registrars create and update the SOA automatically. Route 53 lets you edit it; most others don't.
Questions
Do I need to create an SOA record?
No. Every DNS host creates it when you add the domain, and updates the serial for you.
What is the SOA serial number?
The zone's version number. It goes up with every change so secondary nameservers know to copy the new version.
This page is also available as Markdown.
Lemon Domains keeps every domain you own in one place, with expiry reminders, change monitoring and DNS editing from your AI assistant. Get started free