DNS zone

Definition

A DNS zone is the part of the name tree that a single authority administers: every record of a domain and its subdomains, except those it delegates onward. It is the file you open when you say you are going to change the DNS.

What is in it, and what is not

In practice, the zone is the screen at your DNS host where the lines pile up: an A record for the site, MX records for mail, TXT records for message authentication and ownership checks, CNAME records for aliases. It is served by the name servers the registry declares for the domain — which means a zone can perfectly well exist somewhere that nobody ever queries.

A domain can also have several zones. Delegating a subdomain to another platform creates a child zone, administered elsewhere, with its own servers. That is common when a provider asks for a whole subdomain, and it is why a line added to the parent zone has no effect on that subdomain at all.

The start of a zone

The record that opens it, then the everyday lines.

example.com.       3600   IN   SOA   ns1.example.net. admin.example.com. (
                                     2026091201 7200 3600 1209600 3600 )
example.com.       3600   IN   NS    ns1.example.net.
example.com.       3600   IN   A     203.0.113.10
www.example.com.   3600   IN   CNAME example.com.
example.com.       3600   IN   MX    10 mail.example.net.

The first line, the SOA, opens the zone and carries its serial number. Every change increments it: that is how secondary servers know their copy is stale and that they need to resynchronize.

The usual mistake

Editing the zone at the old DNS host, because that is the interface you know and it still shows the domain. The delegation, meanwhile, already points elsewhere: the line saves correctly, and nobody reads it.

How to avoid it: Before any change, check which name servers the registry declares for the domain, then edit only the zone those servers hand out. An interface showing a domain never proves it is in charge of it.

Source: Zones, delegation and the SOA record are defined in RFC 1034 and RFC 1035.

Related terms

Where to go next

Knowing the words is half the job

The other half is knowing which of your domains is about to become a problem. DomainVigil watches expiry, DNS, certificates and reputation, and tells you before your client does.

Start for free

Five domains free, forever. No card required.

Back to the glossary