Concept
Every DNS zone carries an SOA (Start of Authority) record with a serial number — a version counter that secondaries use to decide whether they need to pull a fresh copy of the zone. When the primary's serial increases, secondaries notice (via a NOTIFY push or their own periodic refresh check) and initiate a zone transfer (AXFR for a full copy, IXFR for an incremental diff) to catch up. This mechanism is what keeps multiple nameservers — which is exactly the redundancy from Lesson 2 — actually in sync rather than just coincidentally similar.
Common Misconception
"The serial number is just a timestamp for reference, it doesn't really matter what it is." It matters enormously — if a serial is accidentally set LOWER than a secondary's current value (a common mistake when manually editing zone files or reverting a change), that secondary will conclude nothing has changed and will keep serving stale data indefinitely, even though the primary has correct, newer records. The serial isn't a label; it's the entire mechanism secondaries use to decide whether to trust that anything changed at all.
Hands-On Exercise
No lab environment needed for basic verification:
- marinadns.io/dig — query your domain's SOA record and read the current serial directly.
- noda.marinadns.io — NODA's SOA Serial Sync check (CAT-INFRA) verifies your serial is consistent across all your nameservers automatically, and SOA Serial Format checks it follows the conventional format.
For the AXFR zone-transfer test (confirming transfers succeed only from authorized secondaries and fail from your lab box) and the manual serial-bump-and-resync exercise, see Lesson 3 in the DNS Admin Course Lab Environment page — an open AXFR test specifically requires querying from outside your DNS provider's own infrastructure.
Commands to Run
# Read the current SOA serial + timers
dig yourdomain.com SOA +short
# Compare serial across primary and every secondary — must match after any change
for ns in $(dig +short yourdomain.com NS); do echo "== $ns =="; dig @$ns yourdomain.com SOA +short; done
# Attempt a zone transfer (should SUCCEED only from an authorized secondary IP, FAIL from elsewhere)
dig axfr yourdomain.com @ns1.yourdnsprovider.com
# From your lab box (should be refused if AXFR is properly locked down):
dig axfr yourdomain.com @ns1.yourdnsprovider.com
Make one small record change, bump the serial per your provider's convention (YYYYMMDDnn is the common one), and re-run the secondary comparison above until all secondaries match.
Mastery Checkpoint
You should be able to explain, without looking anything up:
- Why an SOA serial that decreases (even accidentally) breaks secondary sync silently rather than throwing an obvious error.
- The difference between AXFR (full zone transfer) and IXFR (incremental), and when each is used.
- Why an AXFR that succeeds from an arbitrary, unauthorized IP is a security finding, not a convenience.
If you can answer all three without re-reading this lesson, move to Lesson 4.
← DNS Admin Course Lab Environment
