SOA timers: refresh, retry, expire and minimum
The SOA (start of authority) record holds the zone's administrative settings: its primary nameserver (MNAME), a contact address, the serial number, and four timers that govern how secondary nameservers keep in sync and how long "does not exist" answers are cached.
Why it matters
On classic primary/secondary setups the timers decide how quickly a change reaches your secondaries and how long they keep serving if the primary goes away. On managed DNS they matter less for syncing (providers push changes their own way), but the minimum still sets negative-caching time everywhere, and out-of-range values are a sign a zone was hand-built without much thought.
What each timer does
- Refresh - how often a secondary checks the primary for a new serial. Typical: 1 to 24 hours (3600-86400).
- Retry - if that check fails, how soon to try again. Should be smaller than refresh. Typical: 15 minutes to 1 hour.
- Expire - how long a secondary keeps answering without reaching the primary before it stops. Should be comfortably larger than refresh, typically 1-4 weeks (1209600-2419200), so a long primary outage does not take the zone offline.
- Minimum - now the negative-caching TTL: how long resolvers remember that a name does not exist. Typical: 5 minutes to 1 hour. A very high value means a record you just added can appear missing for a long time.
What the report checks
That the SOA record is present and its MNAME is one of the nameservers listed at the parent, and that refresh, retry, expire and minimum fall in the sane ranges above (RFC 1912 / RFC 2308). Out-of-range values are warnings, not errors.
How to fix it
Set the timers in your zone's SOA (most control panels expose them, or edit the zone file). A safe, common set:
refresh 86400 ; 24h
retry 7200 ; 2h (smaller than refresh)
expire 1209600 ; 14d (larger than refresh)
minimum 3600 ; 1h negative cache
Keep MNAME pointing at a nameserver that actually appears in your delegation.
How to verify
dig example.com SOA +multiline +short
Read the five numbers after the contact address: serial, refresh, retry, expire, minimum.