Every zone has exactly one SOA (start of authority) record at its apex. It names the primary server, the admin mailbox, a serial number and the timers that control zone transfers and negative caching.
google.com. 60 IN SOA ns1.google.com. dns-admin.google.com. 1018071953 900 900 1800 60
; primary ns1.google.com, serial 1018071953, refresh 900 s (15m), retry 900 s (15m), expire 1800 s (30m), negative TTL 60 s (1m)
wikipedia.org. 3480 IN SOA ns0.wikimedia.org. hostmaster.wikimedia.org. 2026102315 43200 7200 1209600 3600
; primary ns0.wikimedia.org, serial 2026102315, refresh 43200 s (12h), retry 7200 s (2h), expire 1209600 s (14d), negative TTL 3600 s (1h)
cloudflare.com. 300 IN SOA ns3.cloudflare.com. dns.cloudflare.com. 2419513043 10000 2400 604800 300
; primary ns3.cloudflare.com, serial 2419513043, refresh 10000 s, retry 2400 s (40m), expire 604800 s (7d), negative TTL 300 s (5m)
github.com. 2484 IN SOA dns1.p08.nsone.net. hostmaster.nsone.net. 1656468023 43200 7200 1209600 3600
; primary dns1.p08.nsone.net, serial 1656468023, refresh 43200 s (12h), retry 7200 s (2h), expire 1209600 s (14d), negative TTL 3600 s (1h)
Secondary servers poll the primary every REFRESH seconds and transfer the zone when the SERIAL has increased. If the primary cannot be reached they retry every RETRY seconds, and stop answering once EXPIRE has passed without a successful refresh.
The last field, MINIMUM, has been redefined by RFC 2308: it is now the TTL for negative answers (NXDOMAIN and "no data"). Resolvers cache a "this name does not exist" answer for the smaller of this value and the SOA record's own TTL, so a high value delays new records from appearing for anyone who looked them up before they existed.
example.com. 3600 IN SOA ns1.example.com. hostmaster.example.com. (
2026111001 ; serial
7200 ; refresh
3600 ; retry
1209600 ; expire
3600 ) ; minimum (negative TTL)Wire format: RDATA is MNAME and RNAME (domain names) followed by five unsigned 32-bit integers.
| Field | Meaning |
|---|---|
| MNAME | The primary nameserver for the zone. |
| RNAME | Admin mailbox with the @ replaced by a dot: hostmaster.example.com. means [email protected]. A dot in the local part is escaped as \.. |
| SERIAL | 32-bit counter that must increase on each change so secondaries notice. A common convention is YYYYMMDDnn. It uses serial-number arithmetic (RFC 1982), so it wraps rather than overflowing. |
| REFRESH | Seconds between secondary checks of the serial. |
| RETRY | Seconds between retries after a failed refresh. |
| EXPIRE | Seconds after which a secondary that cannot reach the primary stops answering for the zone. |
| MINIMUM | Negative-caching TTL (RFC 2308). |