SOA serial numbers and keeping servers in sync
The SOA (Start Of Authority) record carries a serial number that increases every time you change the zone. Secondary nameservers compare their serial to the primary's to know when to pull an update.
What the report checks
- Agreement: every nameserver reports the same serial. If they differ, your nameservers are serving different versions of the zone - a change reached some but not all of them, so visitors get inconsistent answers.
- Format: the serial follows a sane scheme. The common convention is
YYYYMMDDnn(date plus a two-digit counter), which makes it easy to see when the zone last changed. A serial of0is flagged.
Why disagreement happens
Usually a zone transfer failed or is slow: the primary was updated but a secondary has not caught up, or a hidden primary and a provider are out of sync. It can also mean two providers are being edited independently.
How to fix it
Make sure every change bumps the serial, and that transfers between your primary and secondaries are working (check NOTIFY and AXFR/IXFR, or your provider's sync). If you edit at two providers, edit one and let it propagate, or automate the sync.
How to verify
dig example.com SOA +short @<nameserver-1>
dig example.com SOA +short @<nameserver-2>
The serial (the third number in the SOA) should match across every nameserver.