[ DNS & domains ]
SOA records, serial numbers and inconsistent name-server answers
Distinguish authoritative version differences from cached DNS answers, interpret SOA fields and serial arithmetic, and build a reproducible incident record.
By the EmailAuth research team · 9 min read
[ Key points ]
- Identify the authoritative zone before comparing answers.
- Serials use wraparound-aware arithmetic and are not content checksums.
- Separate authoritative disagreement from positive and negative caching.
[ Takeaway ]
Compare exact authoritative answers and SOA versions first, then explain recursive-cache behavior and verify the affected email workflow separately.
[ By role ]
What this means for you
Choose your role for practical next steps.
IT / Mail Admin
Compare the DNS layers
Prove which layer disagrees before changing authentication records.
Next steps
- Capture each authoritative answer and SOA.
- Classify recursive positive or negative cache results.
- Retest the real sending workflow.
CISO / SecOps
Preserve evidence during recovery
An urgent DNS incident still needs controlled, attributable changes.
Next steps
- Preserve the prior zone and approved record data.
- Avoid weakening policy to hide inconsistent answers.
- Require evidence-based closure.
Founder / Non-technical
Protect notification continuity
DNS recovery is complete when the business workflow is accepted.
Next steps
- Name an incident owner and service owner.
- Track customer-facing impact separately from DNS symptoms.
- Require a tested recovery decision.
[ FAQs ]
Frequently asked questions
Does a higher decimal SOA serial always mean a newer zone?
No. DNS uses 32-bit serial arithmetic with wraparound and undefined comparisons for some pairs. Apply RFC 1982 rather than ordinary numeric sorting.
Must the serial use a date format?
No. The serial is a version value. A date-shaped number is an administrative convention and does not independently prove the date of a change.
Do refresh and retry tell users when cached TXT data expires?
No. They describe secondary zone-maintenance timing. Recursive caches use the applicable response TTLs.
What does SOA MINIMUM mean for a negative response?
RFC 2308 uses the smaller of the SOA TTL and MINIMUM for negative caching. It is not a universal TTL for all records in the zone.
Can two authorities have the same serial but different data?
A serial is a version indicator, not a content hash. Compare the affected RRsets as well as serials instead of assuming the data must match.
Why does a new DKIM record still appear absent at one resolver?
A resolver may have cached a negative response. First establish that authoritative publication is correct, then inspect the negative result and applicable TTL.
Should rollback restore the old serial along with the old record?
For a self-managed zone, restore intended content through a supported process that advances versioning correctly. An old serial can leave secondaries holding another version.
Has this article verified any live DNS zone?
No. Its worksheet and fictional incident are diagnostic aids. Authoritative, recursive, received-message, visual and owner checks remain pending.
[ Sources ]
Sources
- RFC 1034
Sections §3.7 Queries · §4.2 How the database is divided into zones · §4.3.1 Queries and responses · §4.3.2 Algorithm · §4.3.5 Zone maintenance and transfers · §5.3.3 Algorithm
- RFC 1035
Sections §3.3.13 SOA RDATA format · §4.1.1 Header section format · §6.3 Zone refresh and reload processing · §7.4 Using the cache
- RFC 1982
Sections §3.1 Addition · §3.2 Comparison · §4 Corollaries · §7 The DNS SOA serial number
- RFC 2308
Sections §2.1 Name Error · §2.2 No Data · §3 Negative Answers from Authoritative Servers · §4 SOA Minimum Field · §5 Caching Negative Answers · §6 Negative answers from the cache
[ Glossary ]
Glossary
- Serial arithmetic
- The wraparound-aware comparison and increment rules used for DNS serial numbers.
- Negative caching
- Retention of a DNS answer indicating that a name or requested data is absent.
- Authoritative answer
- An answer supplied with authority for the relevant DNS zone rather than merely from a recursive cache.
Enterprise provenance
Why top financial institutions and governments retired their email security dashboards.
Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.
EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.
SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption