The SOA negative-caching TTL is outside the usual range
What this check looks for
The timer that controls how long the internet remembers "this name does not exist" is set unusually. ‹consequence›
Why it matters
This is the number that decides how long a name stays broken after you create it. Set to a day, a subdomain someone tried before you added it stays invisible to them for a day, and nothing you do can shorten it.
When the check passes, your report says: “The SOA negative-caching TTL is within the usual range”.
What it costs your score
When this check fails it removes 2 points from your DNS score, before the status, confidence and repeat multipliers are applied. DNS carries a weight of 10 in the overall score.
It shares the dns.health.soa family ceiling of 20 points: however many findings that family produces, together they cannot remove more than that from DNS. One underlying problem showing up in several places is still one problem.
- Severity
- low
- Default confidence
- confirmed
- Status when triggered
- warn
- Deduction
- 2 points
- Family cap
- dns.health.soa · 20
- Category
- DNS
- Module
- Dns health
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Set the SOA minimum to between five minutes and one hour.
It decides how long a name you have just created stays broken for people who tried it earlier.
Edit the SOA record at your DNS host.
Set minimum to 3600 (1 hour), or 300 while you are actively adding records.
Confirm secondaries have picked up the new SOA.
How to confirm it worked
dig +short SOA ‹domain› — check the seventh number (minimum)
{{domain}}. 3600 IN SOA ns1.{{domain}}. hostmaster.{{domain}}. 2026090901 7200 3600 1209600 3600A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
‹domain› publishes a minimum of ‹value› (‹seconds› seconds); the usual range is ‹recommended range›. Since RFC 2308 §4 this field no longer sets a default record TTL — it sets the negative-caching TTL, bounded by the SOA record's own TTL. One hour is the common choice: long enough to absorb typo traffic, short enough that a newly created name works almost immediately.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other dns health checks
- A name has a CNAME alongside other records
- A glue record's address does not match the nameserver's own
- A nameserver inside the domain has no glue record
- A nameserver you delegate to does not answer for the zone
- The domain has fewer than two nameservers
- A nameserver name is an alias rather than a host
- The registry and the zone disagree about the nameservers
- All nameservers resolve to one address
- All nameservers sit in one network block
- A nameserver name has no address
- The delegation could not be checked
- A nameserver answers queries for domains that are not yours