What is in an SOA record, and how do secondary DNS servers stay in sync?
Show the answer
Say this first
The SOA names the primary server (MNAME) and the admin mailbox (RNAME), then five numbers: serial, refresh, retry, expire and minimum. Secondaries check the primary's serial every refresh interval, or at once when the primary sends a NOTIFY. If the serial went up they pull the zone with IXFR (just the changes) or AXFR (the whole zone) over TCP 53. If they cannot reach the primary for the expire time, they stop answering for the zone. The minimum field is now the negative caching TTL.
Go deeper
An SOA, field by field
example.com. 3600 IN SOA ns1.example.com. hostmaster.example.com. (
2026111001 ; serial, YYYYMMDDnn by convention
7200 ; refresh, 2 hours
3600 ; retry, 1 hour
1209600 ; expire, 14 days
3600 ) ; minimum, the negative caching TTLhostmaster.example.com. means the mailbox hostmaster@example.com: the first dot stands for the @.
Rules
- The serial must go up on every change. Lower it by mistake and secondaries ignore the change. Serial arithmetic (RFC 1982) lets you move forward past a mistake in steps.
- NOTIFY (RFC 1996) makes updates near instant. Refresh is the safety net.
- Restrict transfers to your secondaries by address and sign them with TSIG keys. An open AXFR hands anyone your whole zone, which is free reconnaissance.
Hidden primary
A common design: the primary is not listed in the NS records and only feeds the public secondaries. It can live behind a firewall and nobody queries it directly.
They will ask next
One secondary still serves old data after a change. What do you check?
Compare serials:
dig @ns1.example.com example.com SOA +shortand the same against each secondary. Then check that the serial was raised, that the secondary can reach the primary on TCP 53, that it is in the transfer ACL with the right TSIG key, and that NOTIFY is sent to it.What happens when the expire timer runs out?
The secondary stops answering for the zone and returns SERVFAIL rather than serve stale data. A primary dead for longer than expire takes every secondary down with it.
Why do zone transfers use TCP?
A zone is far larger than one UDP message and has to arrive complete and in order.
Traps
- Editing a zone file by hand and forgetting to raise the serial.