Are there any cases where the info in the SOA record or the @ NS records for a domain or subdomain is used in a DNS name resolution?

Let's say that I do not publish any SOA or @ NS records on the josh.com name server, would this have any impact on anything?

Asked differently, is there ever a time that I would expect my private DNS server for the josh.com domain to get a query for @ NS records or for the SOA record?


Say I have my own private DNS server for the domain josh.com. The registrar has the IP address of this name server and publishes it to the TLD servers.

I want to resolve www.josh.com...

  1. I ask root NS servers for com. and they answer with the com NS records in the authority section with IP addresses for the .com GTLD servers in the additional section.

  2. Then I use the IP address for one of the GTLD servers that was returned from the previous step to ask for josh.com. and it answers with the josh.com. name servers in the authority section along with their IP addresses in the additional section.

  3. Finally, I ask one of the josh.com servers that were returned from the previous step for www.josh.com. and get an answer in the answer section.

Is seems that no SOA or @ NS records are ever touched here?

  • Note: AFAIK, in usual practice, all three steps are "I ask [some server] for www.josh.com. i.e. the whole thing" and rely on the server automatically providing referrals (although this may be now changing slightly with QNAME-minimization becoming widespread). – user1686 Jul 6 '19 at 19:07
  • @grawity agreed that for a typical internet user, they will ask a nearby recursive server to do the above steps for them, but to get the final answer for www.josh.com some combination of DNS servers must work thier way down the above steps starting at the root and ending at the josh.com server. My questions is if any of those servers ever cares about the SOA or non@ NS records. – bigjosh Jul 6 '19 at 19:14
  • I wasn't really talking about asking a nearby recursive server... – user1686 Jul 6 '19 at 19:17
  • @grawity but ultimately to answer "www.josh.com", you must find out what the authoritative servers for "josh.com" are, and it seems that info only depends on the the authority section of the answer from the GTLD server rather than from the SOA or @ NS records on the josh.com name server, right? – bigjosh Jul 6 '19 at 19:20

These records are stored inside the zone file and are essential for the functioning of the DNS server and defining the DNS zone itself. They are not normally used when processing DNS queries, but only tell the DNS server where to get its information from.

An SOA record is used by slave or secondary domain servers and points to the primary zone server and contains all the required parameters for syncing with it, such as refresh timings. The process is called DNS zone transfer.

An NS record, or name server record, maps a domain name to a list of DNS servers authoritative for the named domains, which includes mainly delegations. The zone origin may be denoted by a @. These also take part in DNS zone transfers.

The only time that a DNS server gets queried for these records is when it is the primary DNS server for the zone, queried by a slave/secondary DNS server in the process of doing a DNS Zone transfer.

DNS is a vast subject and my knowledge of it is not total. If you wish to learn more, you may start with these resources:

| improve this answer | |
  • So if I write my own minimal DNS server and I implement my own way for keeping my slaves in sync with my master, then I do not support @ NS or SOA queries? Thank! – bigjosh Jul 6 '19 at 21:19
  • Yes, you are at liberty to implement any mechanism you like, as long as the server works correctly, even one that doesn't use a zone file or contains non-standard syntax. – harrymc Jul 7 '19 at 6:27

Let's say that I do not publish any SOA or @ NS records on the josh.com name server, would this have any impact on anything?

Yes, this will break DNSSEC and QNAME minimization, at least. (and ironically you use QNAME minimization in your example...)

Besides the fact that the last item of the SOA field is the negative TTL and let recursive nameservers know for how long to cache NXDOMAIN replies. So the SOA record is needed.

See https://tools.ietf.org/html/rfc7816#appendix-A for a detailed algorithm used by recursive nameservers to do QNAME minimization: you will see it needs NS records to progressively find zone cuts.

There is the same need for DNSSEC as the nameservers need to find the proper DNSKEY and DS records.

Also note in general that NS records exist on both sides of zone cut: in parent zone and in child zone. Recursive nameservers believe what is on the child side, as it is the authoritative side. The NS records in the parent zone are there only for the resolution, but the parent is not authoritative on them. Not having them on the child side (if you manage to have a nameserver loading a zone in that case, which is certainly not guaranteed) may prevent recursive nameservers for any kind of proper caching of data.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.