The zone has no readable SOA record
What this check looks for
Every DNS zone must have a record describing itself. None of your nameservers returned one, which means either the zone is not properly loaded or the servers are not answering for it.
Why it matters
The SOA is what makes a zone a zone: it carries the version number secondaries use to stay in sync and the timer that controls how long "this name does not exist" is remembered. Without it, secondary transfers and negative caching have nothing to work from.
When the check passes, your report says: “The zone publishes a readable SOA record”.
What it costs your score
When this check fails it removes 15 points from your DNS score, before the status, confidence and repeat multipliers are applied. DNS carries a weight of 10 in the overall score.
It shares the dns.health.soa family ceiling of 20 points: however many findings that family produces, together they cannot remove more than that from DNS. One underlying problem showing up in several places is still one problem.
- Severity
- high
- Default confidence
- confirmed
- Status when triggered
- fail
- Deduction
- 15 points
- Family cap
- dns.health.soa · 20
- Category
- DNS
- Module
- Dns health
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Publish a valid SOA record at the zone apex.
Without it the zone cannot be transferred to secondaries and negative answers are not cached.
Check on the primary nameserver that the zone file loads without error.
Confirm the SOA names the primary nameserver and a contact address.
Reload the zone and confirm secondaries have picked up the serial.
How to confirm it worked
dig +short SOA ‹domain› — expect one SOA record
{{domain}}. 3600 IN SOA ns1.{{domain}}. hostmaster.{{domain}}. 2026090901 7200 3600 1209600 3600A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
No nameserver returned an SOA record for ‹domain›. Outcomes were: ‹lookup result›. RFC 1035 §3.3.13 makes the SOA mandatory at the apex of every zone. If the nameservers answered but returned no SOA, the zone is misconfigured on the server; if none of them answered at all, this is the same fault the lame-delegation finding reports and should be fixed there first.
Standards and references
- RFC 1035 §3.3.13 — SOA RDATA format § 3.3.13
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other dns health checks
- A name has a CNAME alongside other records
- A glue record's address does not match the nameserver's own
- A nameserver inside the domain has no glue record
- A nameserver you delegate to does not answer for the zone
- The domain has fewer than two nameservers
- A nameserver name is an alias rather than a host
- The registry and the zone disagree about the nameservers
- All nameservers resolve to one address
- All nameservers sit in one network block
- A nameserver name has no address
- The delegation could not be checked
- A nameserver answers queries for domains that are not yours