The SOA refresh interval is outside the usual range
Updated
What this check looks for
The SOA refresh timer sets how often backup nameservers check the primary for changes. We flag values outside RFC 1912's range of 20 minutes to 12 hours.
In a report, this finding reads as follows, with each ‹…› filled in from what that scan observed:
The timer that tells your backup nameservers how often to check for changes is set unusually. ‹consequence›
Why it matters
Refresh only matters when the usual notification mechanism fails. It is the fallback that decides how long a secondary nameserver can serve an out-of-date copy of your zone before it notices on its own.
When the check passes, your report says: “The SOA refresh interval is within the usual range”.
What it costs your score
When this check fails it removes 2 points from your DNS score, before the status, confidence and repeat multipliers are applied. DNS carries a weight of 10 in the overall score.
It shares the dns.health.soa family ceiling of 20 points: however many findings that family produces, together they cannot remove more than that from DNS. One underlying problem showing up in several places is still one problem.
- Severity
- low
- Default confidence
- confirmed
- Status when triggered
- warn
- Deduction
- 2 points
- Family cap
- dns.health.soa · 20
- Category
- DNS
- Module
- Dns health
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Set the SOA refresh to a value between 20 minutes and 12 hours.
It bounds how long a secondary can serve an old copy when a change notification is lost.
Edit the SOA record at your DNS host — most control panels expose the fields individually.
Set refresh to 7200 (2 hours) unless you have a reason for another value.
Confirm secondaries have picked up the new SOA.
How to confirm it worked
dig +short SOA ‹domain› — check the fourth number (refresh)
{{domain}}. 3600 IN SOA ns1.{{domain}}. hostmaster.{{domain}}. 2026090901 7200 3600 1209600 3600A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
‹domain› publishes a refresh of ‹value› (‹seconds› seconds); the usual operating range is ‹recommended range› (RFC 1912 §2.2). Modern setups rely on NOTIFY rather than the refresh timer, so a value outside the range is rarely urgent — but a very long one still sets the ceiling on how stale a secondary can get if a NOTIFY is lost. When every nameserver is at one provider — all under one registrable domain outside the zone — and nothing shows a primary and secondaries of your own (a primary named elsewhere, a zone handed over by transfer, servers on different serials), the value is reported as information at no cost. If those servers are a managed provider's, the timer governs no secondary of yours and is the provider's to set; if you run them yourself under a separate domain of your own, it governs your own secondaries and the recommended value below still applies.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.