Reading a zone

Module 2: Nameservers and zones · Reading time: 8 minutes

Learning objective: After this lesson you can read and write a DNS record: name, TTL, class and type, and value, including the @ sign and the trailing dot.

Key concepts: zone file, @, relative and full name, trailing dot, SOA, serial number, NS record

The five parts of a record

In technical terms, a zone is often written as a zone file: a text file with one record per line. Even if your panel turns it into a nice form, the same five parts are there:

www.example.com.   3600   IN   A   192.0.2.10
│                   │      │    │   │
name                TTL    class type value

A few examples:

example.com.        3600  IN  A      192.0.2.10
example.com.        3600  IN  MX     10 mail.example.com.
_dmarc.example.com. 3600  IN  TXT    "v=DMARC1; p=none"
shop.example.com.   3600  IN  CNAME  shops.example.net.

There can be several records with the same name and the same type. Two MX records for example.com or two A records for www is perfectly normal. Together they're called a record set.

The @ sign

The @ sign means in a zone: the name of the domain itself. In the zone for example.com,

@   3600  IN  A  192.0.2.10

is the same as

example.com.   3600  IN  A  192.0.2.10

Most panels use @, or leave the name field blank, for the bare domain. If a service asks you for a record "on your domain" or "at the root of your domain", it means @. Note: "root of your domain" is different from the root of the DNS from lesson 1.2.

Relative and full names

In lesson 1.2 you saw the trailing dot. In a zone it works like this:

• If a name ends with a dot, it's full. mail.example.com. is exactly that name.
• If a name doesn't end with a dot, it's relative. The name of the zone is appended to it. In the zone for example.com, mail therefore becomes mail.example.com. (with a dot).

This applies both to the name of a record and to a name in the value, such as with CNAME, MX, NS and SRV. For an IP address in an A or AAAA record it doesn't matter: you never add a dot after that.

Compare:

Panels handle this differently. Some always append your domain name to the name field and show that below the field. Some automatically add a dot after a value. Others just use what you type. There's one safe approach:

1. In Name, enter only the first part (shop, www, _dmarc), or @ for the domain itself.
2. For a value that is a name, enter the full name with a trailing dot, unless the panel clearly states that this isn't needed.
3. After saving, check how the record appears in the list. If you see your own domain name doubled up in it, fix it.

The SOA record: the header of the zone

Every zone starts with exactly one SOA record (start of authority). It contains management data, such as:

example.com.  3600  IN  SOA  ns1.hosting.example. hostmaster.example.com. (
               2026110701 ; serial number
               14400      ; refresh
               3600       ; retry
               1209600    ; expire
               300 )      ; minimum (negative cache)

• The first name is the primary nameserver.
• The second is the administrator's email address, with a dot instead of @: hostmaster.example.com. means hostmaster@example.com.
• The serial number goes up with every change. The other nameservers use this to see that something new has appeared and fetch the zone again. It's often a date with a sequence number, such as 2026110701.
• The last value determines, among other things, how long an answer of "doesn't exist" may be remembered (lesson 6.2).

Your panel usually manages the SOA record itself. You'll almost never need to change it. It is useful to know: if the serial numbers differ between your nameservers, not every nameserver has the latest version.

NS records in the zone

The zone also contains NS records for the domain itself:

@   3600  IN  NS  ns1.hosting.example.
@   3600  IN  NS  ns2.hosting.example.

These should match the nameservers registered with the registry (lesson 2.1). Don't change them without also changing the nameservers at the registrar. An NS record for a subdomain (klant.example.com NS ...) delegates that subdomain to other nameservers. That's advanced work.

In practice: what it looks like in a panel

In DirectAdmin, open DNS Administration. You'll see a table with the columns Name, TTL, Type and Value: exactly the parts from this lesson, without the class. A name followed by a dot, such as example.com., is the domain itself. In My WebOké, on the DNS tab, you enter @ in the Name field for the domain itself, and you'll see the full name below the field. cPanel (Zone Editor), Plesk, Cloudflare and registrar panels work with the same fields; only the button names differ.

Summary

• A record consists of name, TTL, class (IN), type and value.
• @ means the domain itself.
• A name with a trailing dot is full; without a dot, the zone name is appended.
• In Name, enter only the first part, and check how the record looks after saving.
• The SOA record is the header of the zone; the serial number rises with every change.

Quiz

Exercise

Exercise Z2.2: Reading an SOA. Look up the SOA record for sidn.nl (SIDN, the registry of .nl in the Netherlands) using an online tool or dig SOA sidn.nl. Fill in: (1) the primary nameserver, (2) the serial number.

Further reading

These articles describe the panels used by WebOké. With other providers it works in a similar way.

• DirectAdmin guide 5.2: Opening DNS Administration and reading the records
• WebOké manual 5.4: Managing DNS: adding, editing and deleting records
• Managing DNS records in My WebOké (with examples for CNAME, TXT, and external services)