What is SOA?

An SOA (Start of Authority) record is the first record of every DNS zone, holding its primary server, contact address, serial number and timers.

A zone has exactly one SOA record, at its apex, and its seven fields are always in the same order. In example.net. IN SOA ns1.example.net. hostmaster.example.net. 2026102101 10800 3600 604800 3600 they are:

• MNAME ns1.example.net.: the primary server for the zone.
• RNAME hostmaster.example.net.: the contact mailbox, with the @ written as a dot (hostmaster@example.net).
• SERIAL 2026102101: a version number that must go up whenever the zone changes. Many people use the date plus a two-digit counter.
• REFRESH (10800 s), RETRY (3600 s) and EXPIRE (604800 s): how often a secondary checks the serial, how soon it retries after a failed check, and how long it keeps answering when it can't reach the primary at all.
• MINIMUM (3600 s): nowadays the time resolvers may cache a negative answer such as NXDOMAIN, per RFC 2308.

The serial is what makes replication work. A secondary compares the primary's serial with its own and only starts an AXFR or IXFR when the primary's is higher, so a change made without bumping the serial never reaches the secondaries, and a serial set too high by mistake can't simply be lowered again. A NOTIFY only tells secondaries to check the serial sooner. Watch out for software defaults, too: PowerDNS gives new zones an SOA naming a.misconfigured.dns.server.invalid with serial 0 unless default-soa-content is set. Comparing dig example.net SOA +short against each nameserver is the quickest way to see whether they agree. The PowerDNS on Debian lesson fixes that default SOA and then watches serials replicate.