Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was investigating a bunch of spam domains, and none of them have an SOA record. I have never seen this before -- I didn't even know it was possible.

How can DNS work without an SOA record? If it isn't strictly necessary, what are the implications of omitting it?

I don't particularly want to add links to spam sites but an example domain is "vance miller kitchens uk dot co dot uk".

share|improve this question
up vote 5 down vote accepted

There is in fact a SOA record, it's just not where you're expecting it. Let's take a look at the AUTHORITY section...keep in mind that is not in any way affiliated with the nameservers, which are authoritative for

$ dig +norecurse +noall +authority SOA                  3600    IN      SOA     win-k7rk0hedad1. hostmaster. 6 900 600 86400 3600
$ dig +norecurse +short SOA
win-k7rk0hedad1. hostmaster. 6 900 600 86400 3600

This betrays their actual configuration: they have a single zone defined. This simplifies their configuration as they only have to maintain one file. The reason you don't get an answer section for the SOA request is because that isn't the true top of the zone. Keep in mind that this is a terrible configuration: you should never pretend to be authoritative for domains that you're not. Don't emulate this.

SOA records are mandatory. You have to stuff something in that AUTHORITY section where it is required by RFC if you expect the rest of the internet to play nicely with you. Obviously they aren't really authoritative for, but this at least tells other nameservers what the negative TTL should be.

share|improve this answer
+1 Mystery solved, thanks! It was partly shrouded by the fact that host simply replied has no SOA record for this domain, which is sort of understandable, I guess, but clearly wrong (I see now). – tripleee May 8 '14 at 17:14

SOA records pretty much regulate the identity and the update frequency of your DNS servers. If your DNS server is the only authorative DNS server for a domain (Or you control all the authoraties and have a fancy for manual actions), you can omit the SOA record with little to no impact. The only impact might be that some response caching will not happen.

In summary: DNS can work just fine without SOA, SOA just regulates updates to secondary servers, and caching. So it's a really bad idea to not have a SOA record.

share|improve this answer
Thanks. I would still appreciate a bit more detail -- what are the mechanics, which are the parts of the SOA which affect caching? (I assume the caching servers would fall back to fairly conservative TTL values if none are specified, for example?) – tripleee May 8 '14 at 10:43
I'm not entirely sure, as I haven't had to deal with a SOA record issue that wasn't internal. Have you verified if your SOA test was correct? allows you to do SOA tests, which you can then point to the google DNS servers to make sure you get a high authority response. – Reaces May 8 '14 at 11:10
Thanks for the pointer. Yes, it returns what I expect (nothing for the domain itself, just an SOA for the TLD). – tripleee May 8 '14 at 11:26
Only broken nameserver software will allow you to omit a SOA record. RFCs require one SOA record at the top of any zone you are authoritative for. – Andrew B May 8 '14 at 15:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.