DNS SOA Record (Start of Authority)

What is a DNS SOA Record?

The Start of Authority (SOA) record is a mandatory resource record that contains administrative metadata about the DNS zone. It identifies the primary name server, the email of the administrator, the serial number of the zone, and various refresh and retry timers.

The Structure of an SOA Record

An SOA record contains several key fields:

1. Primary Name Server (MNAME): The master name server hosting the authoritative zone files.

2. Responsible Party (RNAME): The email address of the administrator (with the dot replacing the @ symbol).

3. Serial Number: A revision number that increments every time the zone file changes, letting secondary servers know when to sync.

4. Refresh/Retry Timers: Dictate how often secondary servers check the primary server for updates.

Threat Analysis of SOA Exposure

• Email Enumeration: The RNAME field discloses the email of the DNS administrator, making them a target for spear-phishing campaigns.
• Zone Desynchronization: If refresh and retry timers are misconfigured, secondary name servers may serve stale, obsolete records, creating security gaps.
• Serial Number Tracking: Attackers monitor the serial number to track how frequently an organization updates its DNS infrastructure.

Hardening SOA Records

• Use Role-Based Emails: Set the RNAME field to a generic, role-based email alias (e.g., hostmaster.example.com) rather than a personal address.
• Secure Zone Transfer Authentication: Use TSIG (Transaction Signature) keys to cryptographically authenticate zone syncs between primary and secondary servers.
• Adopt Date-Based Serial Numbers: Standardize your serial numbers in the YYYYMMDDNN format to track changes systematically.