DNS SOA record

What it means

The SOA (Start of Authority) record identifies administrative parameters for a DNS zone. It contains a primary server name, responsible party mailbox encoding, a 32-bit serial and timers used by traditional secondary-zone refresh logic. SOA is not the same thing as the TTL of every positive DNS record. Its MINIMUM field has a role in negative caching under RFC 2308, while ordinary RRsets carry their own TTLs.

Try it

Simulation — compare unsigned serials and negative TTL. Set primary 11 and secondary 10, then try primary 0 against secondary 4294967295. The second is newer across wrap. Compare 0 with 2147483648 and the order becomes undefined. Change SOA TTL and MINIMUM and observe the initial negative-response TTL. Advance the illustrative secondary clock; Reset restores the original serials and timers.

How the mechanism works

Secondary DNS software uses the SOA serial to decide whether a zone version may need transfer. RFC 1982 defines serial arithmetic modulo 2^32: the comparison is not an ordinary integer less-than operation around wrap. A difference of exactly 2^31 has no defined order. Therefore a dashboard that merely chooses the numerically larger serial can be wrong.

SOA REFRESH is the interval for a secondary to check the primary; RETRY is relevant after a failed refresh; EXPIRE indicates how long the secondary may continue to use zone data without successful refresh under the protocol's conditions. These do not tell a recursive resolver how long it will retain www A data. For authoritative NXDOMAIN or NODATA, RFC 2308 derives the negative-cache TTL from the smaller of the SOA RR TTL and SOA.MINIMUM in the response. That limit is different from any positive web address RRset TTL.

Primary protocol documentation provides the underlying rules; the interactive state is only a synthetic illustration.

In practice

When investigating secondary disagreement, identify the authoritative zone, read the SOA from each configured server and compare serials using wrap-aware rules. Confirm whether transfers and refresh have actually succeeded from service logs; a higher serial alone does not prove that the full intended data is served. Record current zone contents before authorizing any serial or timer change. If serial order is undefined or transfer state is unknown, stop and reconcile versions before editing. The rollback is to a verified zone backup and controlled serial progression, not a guessed decrement.

Limits and common mistakes

The widget does not perform AXFR/IXFR, model vendor-specific transfer behavior or establish whether a secondary should expire at any observed real time. It uses seconds for a toy timer and assumes authoritative negative-answer conditions. A cached NXDOMAIN does not certify that all resolvers are synchronized.

Key takeaways

Read the SOA serial as a 32-bit value under RFC 1982, not ordinary unbounded arithmetic: even the direction of change can be undefined for a half-space separation. Refresh/retry/expire describe secondary-zone behavior; the initial negative-cache TTL is a different value derived from SOA TTL and MINIMUM.