Understanding the SOA Record: Every Field (Serial, Refresh, Retry, Expire, Minimum) Explained

The Start of Authority (SOA) record sits at the top of every DNS zone and defines how the zone is administered and how secondary servers keep in sync with the primary. Its fields look cryptic, but each controls real behaviour you should understand before editing a zone.

What the SOA looks like

A zone's SOA names the primary nameserver, the admin contact, and five timing values. In a zone file it reads roughly: primary NS, admin email (with the @ written as a dot), then serial, refresh, retry, expire and minimum.

The two names

• MNAME — the primary (master) nameserver for the zone.
• RNAME — the administrator's email, written with a dot instead of @ (so admin.example.com means admin@example.com).

The five timers

• Serial — a version number for the zone. Secondaries compare it to decide whether to pull an update. It must increase on every change; a common format is YYYYMMDDnn. Forgetting to bump it is the classic reason secondaries serve stale data.
• Refresh — how often a secondary checks the primary's serial for changes.
• Retry — if a refresh check fails, how long the secondary waits before trying again.
• Expire — if a secondary cannot reach the primary for this long, it stops answering for the zone entirely (better to go silent than serve very old data).
• Minimum — today this is the negative-caching TTL: how long resolvers cache "this name does not exist" answers.

How the timers interact with secondaries

Refresh, retry and expire only matter when you run secondary DNS using classic zone transfers. Modern setups often use NOTIFY so secondaries update almost immediately rather than waiting for the refresh interval.

Practical guidance

Always increase the serial after edits, keep refresh/retry sensible for how often your zone changes, and set expire comfortably longer than any realistic primary outage. You can inspect any zone's SOA with dig SOA.

Frequently asked questions

What happens if I forget to increment the serial?

Secondary servers will not see a change, so they keep serving the old zone. Bumping the serial is what signals "there is an update to pull". Many control panels increment it for you automatically.

Does the SOA minimum still mean the default TTL?

Not anymore — modern standards redefined it as the negative-caching TTL (how long NXDOMAIN answers are cached). Per-record TTLs, not the SOA minimum, control positive caching today.

What should expire be set to?

Long enough that a temporary primary outage does not make secondaries stop answering — commonly a week or two. It is the safety limit for how long a secondary will serve data without contact from the primary.