SOA record
SOAThe SOA record marks the start of authority for a zone and carries the parameters that govern how it is transferred and cached.
What an SOA record contains
Every zone has exactly one SOA record at its apex. It names the primary nameserver and an administrative contact, and carries a serial number plus several timers.
The administrative contact is an email address written with a dot in place of the @ sign, which is why it looks like a hostname rather than an address.
What an SOA record looks like
An SOA record carries seven fields after the type: example.com. 3600 IN SOA ns1.example.com. hostmaster.example.com. 2026091601 7200 3600 1209600 3600.
The first two are the primary nameserver and the responsible party. That second one is an email address with the first dot standing in for the at sign, so hostmaster.example.com. means hostmaster@example.com.
The five numbers that follow are the serial, refresh, retry, expire and minimum, in that order.
The serial number
Secondary nameservers use the serial number to decide whether their copy of the zone is current. A secondary that sees a higher serial on the primary transfers the zone again.
A serial that fails to increase after an edit is a classic cause of secondaries serving stale data indefinitely. The common convention is a date-based format such as 2026090501, though any increasing number works.
serial
www A
serial
www A
Refresh, retry and expire
These three timers govern secondary nameservers rather than resolvers. Refresh is how often a secondary checks the primary for a new serial, and retry is how long it waits before trying again after a check fails.
Expire is the outer limit: once a secondary has gone that long without reaching the primary, it stops answering for the zone rather than serving data it can no longer confirm. It is deliberately the largest of the three.
A client resolving a name is unaffected by any of them. Nothing here changes how long an ordinary answer is cached, which is what the record TTL does.
The minimum field is negative caching
The final SOA field is named "minimum" but no longer means a minimum TTL. RFC 2308 redefined it as the TTL for negative answers — how long a resolver may remember that a name does not exist.
A high value here means that creating a record someone has already queried for can take a long time to become visible, even though the record itself has a short TTL.