The SOA record and its serial number: what each field means and when it matters

Domains & DNS·· 6 views· 4 min read

The short answer: the SOA (Start of Authority) is the first record in every DNS zone. It names the primary nameserver and the person responsible for the zone, and it carries a serial number plus four timers: they tell secondary nameservers when to fetch the zone again, and tell resolvers how long to remember that a name does not exist. On cPanel hosting the server writes and updates it for you; you read it when you are chasing a change that “does not show up”. If you run a VPS with your own DNS server, keeping it right is your job.

The SOA fields, one by one

Field What it means
Primary nameserver (MNAME) The nameserver holding the original copy of the zone. The secondaries copy from it.
Responsible person (RNAME) An e-mail address written with a dot instead of the @: hostmaster.example.com. means hostmaster@example.com.
Serial number The zone’s version. Secondaries only copy the zone when this number goes up. The usual convention is the date followed by a counter: YYYYMMDDnn.
Refresh How often (in seconds) secondaries ask the primary whether the serial has changed.
Retry If that question fails, how long they wait before asking again.
Expire If this much time passes without reaching the primary, the secondaries stop answering for the zone.
Minimum (the last number) Today it does something else: it is how long a resolver keeps the answer “this name does not exist” (negative caching). The lower of this number and the SOA’s own TTL applies.

Reading and checking the SOA

1 Look at the domain’s SOA from a command line: dig example.com SOA +short
ns1.example.net. hostmaster.example.com. 2026101601 3600 1800 1209600 86400The fields come in the order of the table: the serial is the third one. If you do not have dig, see checking DNS from the command line. (example: example.com is a domain reserved for examples, and 192.0.2.10 and 2001:db8::10 are documentation addresses; replace them with yours.)
2 Compare the serial on every nameserver. List them with dig example.com NS +short, then ask each one: dig @ns1.example.net example.com SOA +short. If one shows a lower number, it has not received the latest version of the zone yet, and that is the one handing out the old answer.
3 On cPanel hosting you do not touch the SOA: when you save a record in the Zone Editor, the server bumps the serial itself. If the serial did not change after an edit, the edit was not saved.
4 On a VPS running BIND (this one is for people who run their own DNS): after editing the zone file, raise the serial, check the file with named-checkzone example.com /path/to/example.com.db and only then reload the zone with rndc reload example.com. Paths depend on the installation.
5 Created a subdomain and it “does not exist” for you only? If you tested it before creating it, your resolver stored the “does not exist” answer for the time in the SOA’s last field. Ask the nameserver directly with dig @ns1.example.net name.example.com to see the truth, and check where else the cache hides.
Never lower the serial. If someone types it by hand lower than it was (for example, switching from a plain counter to the date format the wrong way round), the secondaries ignore every change until the number climbs past the old one. There is a proper procedure to fix it (serial arithmetic, from RFC 1982); do not guess, ask for help.
The date format is a free clue: with YYYYMMDDnn, one glance tells you the day the zone last changed and how many edits happened that day. It is the quickest answer to “was my change saved?”.

Serial numbers that do not match between nameservers, or a zone that will not update? Tell us the domain and what you changed.

Open a support ticket

SEE ALSO

Checking DNS from the command line: dig and nslookup, and how to read the answer

I changed the DNS and nothing shows yet: TTL, cache, and the four places to check

Nameservers: what they are and which ones to use with us

Pointing a domain at your own VPS: nameservers and glue records

How long DNS changes take to propagate

Reading a whole DNS zone line by line: names, trailing dots, TTL and the @ sign

RECOMMENDED PRODUCT

Web hosting with cPanel

Domain and SSL included, daily backups and the panel you already know. from $6.60/mo (3-year plan, with coupon)

See plans
Was this answer helpful? Your answer helps us improve this article.

Related Articles

Domains & DNS 1 543 How to check a domain DNS Checking a domain’s DNS means finding out where it currently points. It is the first step whenever a site will not open,...
Domains & DNS 1 574 How to find the hosting DNS Whenever you need to point a domain at your MozOut hosting, you will be asked for the nameservers - also called DNS serv...
Domains & DNS 1 593 How to configure a domain DNS Configuring DNS means telling the world where your domain should point. There are two levels, and it is worth separating...
Domains & DNS 1 528 How to change the DNS of a domain already in use Changing the DNS of a domain that already works takes more care than setting up a new one. Here you are not starting fro...
Domains & DNS 1 586 How long DNS changes take to propagate You changed the nameservers or a DNS record and nothing happened yet. That's normal - DNS changes are not instant. How l...
Domains & DNS 2 CNAME on the bare domain: why it is not allowed and what to use instead The short answer: a CNAME says “this name is really that other name”. The DNS standard forbids a CNAME on a name that ha...