SOA record

A zone is defined by its SOA record. Exactly one sits at the apex, it names the primary server and the contact address, and it carries the replication timers and the negative-answer TTL. A name with NS records and no SOA is not a zone — it is a delegation pointing at servers that do not have one.

The check asks the domain's own nameservers for the apex SOA directly. Where NS records exist and no SOA comes back, the server either does not hold the zone at all — which the lame-delegation check will also be reporting — or holds it in a broken state, which for most implementations means the zone failed to load and the server is now refusing everything under it.

The SOA also does work that is easy to overlook: it is returned in the authority section of NXDOMAIN and empty answers, and its minimum field is what tells a resolver how long it may remember that a name does not exist. Without it, negative answers cannot be cached at all, and every lookup for a name that is not there becomes a fresh query to your servers.

On managed DNS this record is generated for you, and its absence means the zone is not loaded. Create or re-add the zone at the provider.

On a self-hosted server, read the log rather than the zone file. Most implementations reject a zone with any syntax error outright and then answer SERVFAIL or REFUSED for every name in it, so a missing SOA is usually the visible end of a parse error higher up the file.

If the SOA is present on some servers and not others, treat it as a replication failure rather than a zone-content problem — the serial and NS-set agreement checks describe the same fault in more detail.