Managing DNS Start of Authority Parameters in Oracle Cloud Infrastructure

Managing your zone's Start of Authority (SOA) parameters in Oracle Cloud Infrastructure ensures that secondary nameservers and resolvers know how to handle your zone data, caching durations, and serial numbers. The SOA record is the foundation of any DNS zone, dictating critical parameters like the primary nameserver, administrative contact, and refresh timers.

Whether you are troubleshooting propagation delays or migrating domains into OCI, understanding how to configure these values correctly prevents widespread resolution failures. You can quickly verify your current authoritative parameters using the SOA Lookup tool on XiaTools to inspect live responses directly from your authoritative nameservers without querying local recursive caches.

Understanding the Anatomy of an OCI DNS SOA Record

When you host a zone within Oracle Cloud Infrastructure, OCI automatically generates a default SOA record for your domain. This record contains several distinct numerical parameters that govern zone maintenance across the internet.

example.com. 3600 IN SOA ns1.oraclecloud.com. dns.oraclevcn.com. (
        2026033001 ; serial
        10800      ; refresh (3 hours)
        3600       ; retry (1 hour)
        604800     ; expire (1 week)
        3600       ; minimum TTL (1 hour)
)

Every parameter plays a specific role in maintaining synchronization between primary and secondary DNS providers:

• Primary Nameserver: The primary source of truth for the zone data. In OCI, this typically points to the Oracle nameserver assigned to your zone.
• Responsible Mailbox: The email address of the administrator, formatted with a dot instead of an @ symbol (e.g., dns.oraclevcn.com translates to dns@oraclevcn.com).
• Serial Number: A version integer that tells secondary nameservers whether they need to pull an updated copy of the zone. If the serial number increases, secondaries initiate a zone transfer.
• Refresh: The time interval that secondary nameservers wait before checking the primary nameserver for serial number updates.
• Retry: The time interval secondary nameservers wait before retrying a failed zone transfer attempt.
• Expire: The maximum time secondary nameservers will authoritative-serve old zone data if the primary nameserver becomes completely unreachable.
• Minimum TTL: The default Time to Live for negative caching (how long resolvers cache the fact that a record does not exist).

How to View and Verify Your OCI DNS SOA Record

Before making any modifications, you must inspect your current OCI DNS settings to establish a baseline. You can perform this verification using standard command-line network utilities or web-based diagnostic tools.

Using Dig

To query the SOA record for example.com directly from an authoritative OCI nameserver, run the following command in your terminal:

dig @ns1.oraclecloud.com example.com SOA +multiline

Sample output:

;
;; QUESTION SECTION:
;example.com.in

;; ANSWER SECTION:
example.com.		3600	IN	SOA	ns1.oraclecloud.com. hostmaster.example.com. (
				2026033001 ; serial
				10800      ; refresh
				3600       ; retry
				604800     ; expire
				3600 )     ; minimum TTL

;; AUTHORITY SECTION:
example.com.		3600	IN	NS	ns1.oraclecloud.com.
example.com.		3600	IN	NS	ns2.oraclecloud.com.

;; QUERY SECTION:

Using PowerShell

If you are managing your infrastructure from a Windows environment, use the Resolve-DnsName cmdlet:

Resolve-DnsName -Name example.com -Type SOA -Server ns1.oraclecloud.com

Step-by-Step: Updating SOA Parameters in OCI

By default, OCI manages SOA serial numbers automatically based on zone changes. However, you can modify configurable timers through the OCI web console or via API tooling.

1. Log in to the Oracle Cloud Infrastructure Console using your credentials.
2. Open the navigation menu and select Networking, then choose DNS Zones.
3. Locate your managed zone (e.g., example.com) in the list and click on its name to open the zone details page.
4. Click on the Records tab to view all DNS records associated with the zone.
5. Filter the record type by SOA to isolate the Start of Authority entry.
6. Click the action menu (three vertical dots) next to the SOA record and select Edit.
7. Modify the desired parameters such as Refresh, Retry, Expire, or Minimum TTL according to your operational requirements.
8. Click Save Changes to commit the updates to the primary OCI nameservers.

Parameter	Recommended Default	High-Frequency Update Setting	Description
Refresh	10800 (3 hours)	3600 (1 hour)	How often secondaries check for updates
Retry	3600 (1 hour)	900 (15 minutes)	Interval to retry failed zone transfers
Expire	604800 (1 week)	1209600 (2 weeks)	When to drop zone data if primary is down
Minimum TTL	3600 (1 hour)	300 (5 minutes)	Negative caching duration

Managing Serial Number Formats

The SOA serial number is the single most critical element for zone propagation. OCI typically utilizes an integer format based on the date and an incremental daily revision (e.g., YYYYMMDDNN).

When updating zone files or migrating from an external DNS provider into OCI, ensure your serial number strictly increases. If you migrate a zone and the new primary uses a lower serial number than what secondary nameservers previously cached, secondary providers will reject the zone transfer, causing stale resolution errors.

Troubleshooting Common OCI DNS SOA Issues

Misconfigured SOA records can cause subtle propagation failures and intermittent resolution timeouts. Here is how to diagnose and fix the most frequent problems.

Stale Serial Numbers During Migrations

• Symptom: After importing a zone into OCI, external secondary nameservers or corporate resolvers continue serving old IP addresses from your previous provider.
• Cause: The serial number assigned in OCI is lower than or equal to the serial number cached by the secondary nameservers.
• Fix: Manually increment the OCI SOA serial number to a value strictly higher than your old provider's final serial number, or re-trigger a full zone transfer (AXFR) from the OCI console.

Invalid Mailbox Formatting

• Symptom: Zone validation fails when importing custom zone files containing an SOA record.
• Cause: Using an @ symbol inside the responsible mailbox field instead of replacing the [@] with a dot.
• Fix: Change entries like admin@example.com to admin.example.com in the raw zone file format.

OCI DNS SOA Configuration Checklist

• Verify that the primary nameserver points correctly to your assigned OCI nameserver (e.g., ns1.oraclecloud.com).
• Ensure the responsible email address uses dot notation instead of an at-sign.
• Confirm the serial number follows a standard incrementing integer format.
• Test zone propagation across global resolvers using a diagnostic tool.
• Check that TTL and refresh timers match your operational change frequency.