# SOA record

Every DNS zone has exactly one SOA (start of authority) record, at its root. It names the primary nameserver and a contact address, carries the zone's version number, and sets the timers that secondary servers and resolvers follow, including how long a "this doesn't exist" answer is cached. Your DNS host manages it for you.

- Record type: SOA
- Type number: 6
- Used for: Delegation
- How common: Common
- Defined in: RFC 1035, RFC 2308

## Format

```
@ <ttl> IN SOA <primary ns> <contact> <serial> <refresh> <retry> <expire> <minimum>
```

| Field | What it means | Accepted values |
| --- | --- | --- |
| Primary nameserver (MNAME) | The main server for the zone. | A host name. |
| Contact (RNAME) | The admin's email address, with the @ written as a dot. | `hostmaster.example.com.` means hostmaster@example.com. Dots before the @ are escaped: `john\.doe.example.com.` |
| Serial | The zone's version. Secondary servers copy the zone when it goes up. | 0 to 4294967295. Often YYYYMMDDnn, such as 2026102401. |
| Refresh | How often secondaries check the serial. | Seconds; 3600 to 86400. |
| Retry | How soon secondaries retry after a failed check. | Seconds; shorter than refresh. |
| Expire | How long secondaries keep answering if they can't reach the primary. | Seconds; one to four weeks. |
| Minimum | Since RFC 2308: how long resolvers cache "no such name" and "no such record" answers. | Seconds; 300 to 3600 is sensible. |

## Examples

### A typical SOA

```
@ 3600 IN SOA ns1.example.com. hostmaster.example.com. 2026102401 7200 3600 1209600 300
```

Secondaries check every 2 hours, retry after 1 hour, give up after 2 weeks; missing names are cached for 5 minutes.

### Cloudflare's style

```
example.com. 1800 IN SOA ada.ns.cloudflare.com. dns.cloudflare.com. 2353104512 10000 2400 604800 1800
```

Managed hosts pick their own values and bump the serial on every change.

## Why the minimum field matters to you

If someone looks up a record before you create it, resolvers remember that it didn't exist for the SOA's minimum value (or the SOA's own TTL, if lower). A long value is why a brand-new subdomain can seem to take ages to appear for some people. Hosts that let you edit the SOA should keep it at an hour or less.

## TTL

Set by your DNS host, usually 1800 to 3600.

## Common mistakes

- Writing the contact as an email with @.
- Editing the zone on a self-run primary without raising the serial, so secondaries never pick up the change.
- Setting the serial in the future (or overflowing it), which needs a careful reset.
- A negative caching (minimum) value of a day or more.

## At your DNS host

- Cloudflare, Route 53 and most registrars create and update the SOA automatically. Route 53 lets you edit it; most others don't.

## Questions

### Do I need to create an SOA record?

No. Every DNS host creates it when you add the domain, and updates the serial for you.

### What is the SOA serial number?

The zone's version number. It goes up with every change so secondary nameservers know to copy the new version.

## Related

- [NS record](https://lemon.domains/dns-records/ns.md)
- [DNS TTL (time to live)](https://lemon.domains/dns-records/ttl.md)
- [DNSKEY record](https://lemon.domains/dns-records/dnskey.md)

Interactive version with a record checker and live lookup: https://lemon.domains/dns-records/soa