SOA records and authority

Every ordinary DNS zone has an SOA, or Start of Authority, record.

It describes zone administration. A typical answer contains:

• the primary nameserver field, traditionally called MNAME
• a responsible-party value, with the first dot standing in for @
• a serial number identifying a zone version
• refresh, retry, and expiry timers used by secondary authoritative servers
• a final value involved in negative-answer caching

The primary field is DNS metadata. It does not identify the website’s origin server, and on a managed platform it may not describe the provider’s internal source of truth.

The serial should change when zone contents change so secondary servers can detect a newer version. Many managed DNS providers update it automatically. When several authoritative servers give inconsistent answers, compare their SOA serials as one clue:

dig +noall +answer SOA flaviocopes.com
authoritative_server=$(dig NS flaviocopes.com +short | head -n 1)
dig @"$authoritative_server" +noall +answer SOA flaviocopes.com

The SOA also appears in the authority section of authoritative NXDOMAIN and no-data responses. Resolvers use the SOA TTL and its final field to determine how long the negative result may be cached. This is one reason a recently created name can remain missing for some users.

Do not edit SOA timers casually. Secondary transfer behavior and negative caching affect availability, and managed providers often intentionally control these values.

Your action is to query the SOA through your normal resolver and directly from two authoritative servers. Identify the primary field, serial, and negative-cache value, then compare the serials.