SOA record

SOA means Start of Authority and is a significant part of a zone file in the domain name system (DNS). A SOA-Record contains important management information about the zone, especially regarding the zone transfer. The SOA-Record is specified in RFC 1035.

Background

Normally DNS name servers are set up in clusters. The database within this clusters is synchronized through zone transfers. The SOA-Record in the zone file contains data to control the zone transfer. This is the serial number and different timespans.

It also contains the e-mail-address of the responsible person for this zone as well as the name of the primary master server. Usually the SOA-Record is located at the top of the zone. A zone without a SOA-Record does not meet the standard and is therefore not transferable.

Structure

name

name of the zone

IN

zone class (usually IN for internet)

SOA

abbreviation for Start of Authority

Primary

primary master for this zone, practically not very meaningful

* it is defining to which server dynamic updates should be sent

* it defines to which server no notifies should be sent

Mail-Address

mail address of the responsible of this zone. (The @ is replaced with a .. Dots before the @ are replaced with \.; e.g. john\.doe.example.com for the mail address john.doe@example.com)

Serial Number

is increased at every change (common naming scheme: YYYYMMDDVV; is a hint when the zone was updated the last time)

Refresh

number of seconds after which secondary name servers should request the serial number from the primary name server, to detect zone changes. Recommendation of RIPE  for small and stable zones: 86400 ≙ 24 hours

Retry

number of seconds after which secondary name servers should retry to request the serial number from the master if the master does not respond. It must be less than Refresh. Recommendation of RIPE NCC for small and stable zones: 7200 ≙ 2 hours

Expire

number of seconds after which secondary name servers should stop answering request for this zone if the master does not respond. This value must be bigger then the sum of Refresh and Retry. Recommendation of RIPE NCC for small and stable zones: 3600000 ≙ 1000 hours

TTL

Time to Live for negative caching (Recommendation of RIPE NCC for small and stable zones: 172800 ≙ 2 days). Originally this field had the meaning of a minimum TTL value for all resource records of this zone and was used in the field if no TTL was specified. This was obsolated by RFC 2308.

Sample SOA Record in BIND

@   IN SOA master.example.com. hostmaster.
example.com. (
    2017030300 ; serial
    3600       ; refresh
    1800       ; retry
    604800     ; expire
    600 )      ; ttl

Serial number changes

As method for serial number changes two methods have been established

• The initial serial number is 1 and is increased at every change
• The serial number contains the year, month and day of the last change followed by a two digit counter (e.g. 2017030301 = 3. March 2017, 1st change at this day) or sometimes the current time. This method is recommended in RFC 1912 2.2