Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

It's been entirely too long since I setup a bind server. I've creating a lot of Windows DNS servers lately so I wanted to try my hand at it on CentOS 6. Unfortunately I'm having a slew of trouble setting up the zone files.

Host Name:

When I try to start the service I get the following error message: SOA record not at top of zone (
zone loading from master file failed: not at top of zone
zone not loaded due to errors.
_default/ not at top of zone
zone localhost.localdomain/IN: loaded serial 0
zone localhost/IN: loaded serial 0
zone loaded serial 0
zone loaded serial 0
zone loaded serial 0

I modified the /etc/named.conf file to include my new zone and the file is setup as so:

options {
    listen-on port 53 {; };
    listen-on-v6 port 53 { ::1; };
    directory       "/var/named";
    dump-file       "/var/named/data/cache_dump.db";
    statistics-file "/var/named/data/named_stats.txt";
    memstatistics-file "/var/named/data/named_mem_stats.txt";
    allow-query     { localhost; };
    recursion yes;

    dnssec-enable yes;
    dnssec-validation yes;
    dnssec-lookaside auto;

    /* Path to ISC DLV key */
    bindkeys-file "/etc/named.iscdlv.key";

    managed-keys-directory "/var/named/dynamic";
    forwarders { <IP_ADDR_1>;<IP_ADDR_2>;<IP_ADDR_3>;};

zone "" IN {
    type master;
    file "";
    allow-update { none; };

logging {
    channel default_debug {
            file "data/";
            severity dynamic;

zone "." IN {
    type hint;
    file "";

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

I then created a new zone file /var/named/ which is configured as such. I can't figure out what I did wrong with the SOA record at the top, or if there are other issues with my zone file:

$TTL 86400
@       IN      SOA (
                    2013008413      ; serial
                    21600           ; refresh after 6 hours
                    3600            ; retry after 1 hour
                    604800          ; expire after 1 week
                    86400 )         ; minimum TTL of 1 day

    IN      NS

            IN      A

shield      IN      A

I used the following resources and I just find myself getting more and more lost staring blankly at the zone file. This is the only server in the environment multi-hosting different services:

Bind Configuration Files:

DNS Sample Zone:

share|improve this question
Are you certain that those logs are with these exact config files? It seems like your $ORIGIN line might be a mismatch with your zone "" IN configuration. Do those configurations match exactly? Try just removing the $ORIGIN line completely to see if that helps. – Shane Madden Mar 29 '13 at 4:39
Like a charm. If you post it as an answer I will give you credit. Thank you very much. – Dion Pezzimenti Mar 29 '13 at 4:47
Glad that it worked! Added an answer with a bit more elaboration/context. – Shane Madden Mar 29 '13 at 5:10
up vote 2 down vote accepted

The log entry SOA record not at top of zone ( is a hint that something is amiss; the SOA record at the top of the file is not being considered as the entry for the domain that's supposed to be handled by this zone file.

This could be caused by the $ORIGIN line mismatching from the zone "" IN { line in the named.conf file, either due to an actual mismatched or something like a UTF-8 string handling problem.

An easy workaround in this case is to simply remove the $ORIGIN line from the zone file; it will then be automatically built based on the zone definition in named.conf, ensuring that those strings will match.

share|improve this answer
Specifically, $ORIGIN mismatches because it lacks a trailing dot. The end result is a SOA record of – Andrew B Mar 29 '13 at 5:47
That does make a lot of sense. The sad part is I do know this is how DNS works. I guess I've been pampered working with Windows DNS servers because it typically appends the period at the end if it realizes it's missing. I added $ORIGIN at the top again ensuring the period was added. Service started successfully. – Dion Pezzimenti Mar 29 '13 at 13:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.