The SOA expire interval is outside the usual range
Updated
What this check looks for
The SOA expire timer sets how long backup nameservers keep answering for your zone after losing the primary. We flag values outside two to four weeks.
In a report, this finding reads as follows, with each ‹…› filled in from what that scan observed:
The timer that says how long a backup nameserver may keep serving your zone after losing contact with the primary is set unusually. ‹consequence›
Why it matters
Expire is the last line of defence in a long outage. Set too short, a problem at the primary that lasts a few days turns into total unreachability as the secondaries give up one by one — the exact moment you most need them still answering.
When the check passes, your report says: “The SOA expire interval is within the usual range”.
What it costs your score
When this check fails it removes 2 points from your DNS score, before the status, confidence and repeat multipliers are applied. DNS carries a weight of 10 in the overall score.
It shares the dns.health.soa family ceiling of 20 points: however many findings that family produces, together they cannot remove more than that from DNS. One underlying problem showing up in several places is still one problem.
- Severity
- low
- Default confidence
- confirmed
- Status when triggered
- warn
- Deduction
- 2 points
- Family cap
- dns.health.soa · 20
- Category
- DNS
- Module
- Dns health
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Set the SOA expire to between two and four weeks.
A short expire converts a primary outage into a complete outage.
Edit the SOA record at your DNS host.
Set expire to 1209600 (14 days).
Confirm secondaries have picked up the new SOA.
How to confirm it worked
dig +short SOA ‹domain› — check the sixth number (expire)
{{domain}}. 3600 IN SOA ns1.{{domain}}. hostmaster.{{domain}}. 2026090901 7200 3600 1209600 3600A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
‹domain› publishes an expire of ‹value› (‹seconds› seconds); the usual range is ‹recommended range› (RFC 1912 §2.2). Two to four weeks is the convention because it is comfortably longer than any plausible primary outage and short enough that a genuinely abandoned zone eventually stops being served. When every nameserver is at one provider — all under one registrable domain outside the zone — and nothing shows a primary and secondaries of your own (a primary named elsewhere, a zone handed over by transfer, servers on different serials), the value is reported as information at no cost. If those servers are a managed provider's, the timer governs no secondary of yours and is the provider's to set; if you run them yourself under a separate domain of your own, it governs your own secondaries and the recommended value below still applies.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.