DNS SOA and NS Records Explained (Serial, TTL)

Every DNS zone starts with an SOA record and a set of NS records. The SOA (Start of Authority) holds administrative settings for the zone; NS records say which nameservers are authoritative for it. You rarely edit them, but understanding them makes DNS problems much easier to solve.

Before you start

This guide uses dig, available on Linux and macOS (and on Windows through WSL or BIND tools).

The SOA record

example.com. 3600 IN SOA ns1.example.com. hostmaster.example.com. (
    2026051401 ; serial
    3600       ; refresh
    900        ; retry
    1209600    ; expire
    300 )      ; minimum / negative TTL

Field	Meaning	Typical value
Primary nameserver	The primary source of the zone	`ns1.example.com.`
Responsible mailbox	Admin email with the first `@` written as a dot	`hostmaster.example.com.` = hostmaster@example.com
Serial	Version number; must increase on every change	Date-based `YYYYMMDDnn`
Refresh	How often secondaries check for updates	1–24 hours
Retry	Wait before retrying a failed refresh	Less than refresh
Expire	When secondaries stop answering if the primary is unreachable	1–4 weeks
Minimum	How long resolvers cache "does not exist" answers (NXDOMAIN)	5 minutes to 1 hour

The last field matters more than people expect: if you look up a name before creating it, resolvers cache the "not found" answer for this long.

NS records

example.com. 86400 IN NS ns1.example.com.
example.com. 86400 IN NS ns2.example.com.

NS records appear in two places:

At the parent zone (the .com registry) – set through your registrar. This is the delegation that sends the world to your nameservers.
In your own zone – should list the same servers.

If the two sets disagree, some resolvers use one and some the other, causing confusing, intermittent results.

Glue records

If your nameservers live inside the domain they serve (ns1.example.com for example.com), resolvers face a chicken-and-egg problem. The registry therefore publishes glue records – the nameservers' IP addresses – created at your registrar as child or private nameservers.

Check SOA and NS records

Delegation at the parent: dig example.com NS +trace
NS in the zone: dig @ns1.example.com example.com NS +short
Serial on each nameserver: dig @ns1.example.com example.com SOA +short and the same for ns2 – the serials should match.

Troubleshooting

Secondary serves old data: the serial was not increased, or zone transfer is blocked.
New subdomain shows "not found" for a while: the negative TTL from an earlier lookup is still cached.
Lame delegation: an NS record points to a server that is not authoritative for the zone; fix it at the registrar or on that server.

FAQ: SOA and NS records

Do I need to edit the SOA on cPanel?

No. cPanel updates the serial automatically whenever you change a record in the Zone Editor.

How many NS records should a domain have?

At least two, on separate servers and ideally separate networks.

What is a good TTL for NS records?

NS records change rarely, so long TTLs such as 1–2 days are common.

Next steps

Was this guide helpful?

Still stuck?

Ask MdmHost AI for a quick answer, or open a ticket and our team will take a look. We are here 24/7.

Ask MdmHost AI Open a ticket