DNS Infrastructure: Name Servers, Redundancy and SOA
Every visit to your site and every email to your domain starts with a DNS lookup. The name servers listed for your domain answer those lookups. If none of them answers, the website, email and any API on the domain all become unreachable at once, even though the servers behind them are fine.
At least two name servers
DNS was designed with redundancy built in: RFC 1034 requires at least two name servers for every zone, and most registries enforce it. Resolvers pick among the listed servers and retry another one if a server doesn’t answer.
Every mainstream DNS provider assigns two or more name servers. If only one shows up, the usual cause is that only one was entered at the registrar.
Separate networks
Two name servers in the same data centre, or behind the same router, fail together. RFC 2182 recommends placing them on different networks and in different locations.
Large providers such as Cloudflare, Amazon Route 53 and Google Cloud DNS use anycast: each name server address is announced from many locations at once, and their name servers’ addresses sit in different network ranges. That covers this requirement on its own.
If you run your own name servers, or your host’s two servers sit side by side, add a secondary DNS provider. The primary sends zone updates to the secondary through zone transfers (AXFR/IXFR), and you list both providers’ name servers at your registrar.
The SOA record
Each zone has one Start of Authority (SOA) record:
example.com. SOA ns1.example.net. hostmaster.example.com. (
2026102801 ; serial
7200 ; refresh: secondaries check for changes every 2 h
900 ; retry: after a failed check, try again in 15 min
1209600 ; expire: stop answering after 14 days without contact
3600 ) ; minimum: how long "name does not exist" is cached
- Refresh, retry and expire tell secondary servers how to keep their copy of the zone in sync. RFC 1912 discusses sensible ranges. Retry should be shorter than refresh, and expire much longer, or secondaries drop the zone between checks.
- Minimum is, since RFC 2308, the time resolvers cache a negative answer (“this name doesn’t exist”). RFC 2308 notes that one to three hours works well and that values over a day cause problems: a record you add would stay invisible to anyone who looked it up just before.
Managed providers often replicate zones their own way, so the refresh, retry and expire values matter less there, but they are still published and read by any secondary you add.
How to fix
- Missing name server. Copy every name server your DNS provider lists into the registrar’s name server settings. Cloudflare shows its two assigned name servers on the domain’s overview page; cPanel and Plesk hosts list theirs in the welcome email or panel.
- One network. Move DNS to a provider with anycast name servers, or add a secondary DNS provider as described above.
- SOA values. Use your provider’s defaults where they can’t be edited. Where you manage the zone yourself (BIND, PowerDNS, a Plesk or cPanel server), set refresh between 1 and 24 hours, retry shorter than refresh, expire longer than refresh, and the minimum between 5 minutes and 1 day. Increase the serial whenever you change the zone.
Check what the world sees:
dig +short NS example.com
dig +short SOA example.com
How PerfoMetrix checks this
We query public DNS resolvers for the registrable domain (example.com, also when you scan
www.example.com). We don’t contact your name servers directly and don’t compare the registry’s
delegation with the zone’s own NS records.
| Check | Result |
|---|---|
| At least two servers | passes with two or more NS records, fails with one |
| Separate networks | passes when the name servers’ IPv4 addresses fall in at least two /24 networks |
| DNS provider | information: the provider recognised from the name server names |
| SOA timers | needs attention when one of the values below is found |
The SOA values we flag: refresh below 300 seconds or above 86,400 seconds, retry longer than refresh, expire shorter than refresh, or a negative-caching TTL (minimum) above one day.
The network check compares the first three parts of each IPv4 address. Anycast providers pass when their addresses differ in those parts, even though each address is served from many places.