Support Library
SOA Record Tuning
What each SOA field does, sensible values for refresh, retry, expire and the negative TTL, and the serial mistakes that stall secondaries.
The short answer
Every zone has one SOA (Start of Authority) record at its apex. Its seven fields name the primary server and a contact, carry a serial number that secondaries use to detect changes, set the timers secondaries use for zone transfers, and set how long resolvers cache "no such name" answers. If your provider manages the zone for you, only the last field usually matters to you; the transfer timers matter when you run your own secondaries.
$ dig +short example.com SOA
ns1.example.net. hostmaster.example.com. 2026102401 7200 3600 1209600 3600The fields
| Field | Example | Meaning | Typical value |
|---|---|---|---|
| MNAME | ns1.example.net. | The primary name server, used for dynamic-update discovery rather than ordinary lookups. NOTIFY goes to configured secondaries; the default NS-based notification set excludes MNAME (RFC 1996). | Your primary, or the provider's main server |
| RNAME | hostmaster.example.com. | The contact mailbox with the first dot standing for @, so this is hostmaster@example.com | A monitored role address |
| SERIAL | 2026102401 | Version number of the zone. Secondaries transfer the zone when it increases. | Date plus a two-digit counter, or a counter the provider manages |
| REFRESH | 7200 | How often a secondary checks the primary's serial, in seconds | 3,600 to 86,400; lower matters less if NOTIFY works |
| RETRY | 3600 | How long a secondary waits after a failed check | Less than REFRESH |
| EXPIRE | 1209600 | How long a secondary keeps serving the zone without reaching the primary, before it stops answering | 1,209,600 to 2,419,200 (two to four weeks) |
| MINIMUM | 3600 | The negative caching TTL: how long resolvers remember that a name or record does not exist (RFC 2308) | 300 to 3,600 |
RIPE-203 gives the classic recommendations for these timers. Managed providers often use their own values and do not let you change some of them.
Tuning decisions that matter
- Negative TTL. A long MINIMUM means that if someone queries a name just before you create it, they keep getting NXDOMAIN for that long. Keep it short, an hour or less, if you add records often. Resolvers actually use the lower of MINIMUM and the SOA record's own TTL. See negative caching.
- EXPIRE too short. If the primary is down for longer than EXPIRE, every secondary stops answering and the zone disappears. Err long.
- Serial that goes backwards. Secondaries ignore a lower serial, so changes stop reaching them. Serial arithmetic (RFC 1982) allows recovering by stepping forward, but the simplest fix is to never decrease it.
- Serials that differ between servers. With your own secondaries, every server should show the same serial a few minutes after a change. A secondary stuck on an old serial is serving an old zone.
| Command | Use |
|---|---|
| dig +nssearch example.com | The SOA serial from every listed name server, to compare |
| dig +norecurse @ns2.example.net example.com SOA | One server's SOA, directly |
How DNS Panopticon helps
Domain Visualizer reads the SOA record through a public resolver. It reports a missing SOA, flags one that does not have all seven fields, and otherwise shows the record's values. It does not judge whether the timers are sensible, and it does not compare serials between name servers, so use dig +nssearch for that. Zone Analyzer can filter a zone export to its SOA and NS rows.