Introduction

A zone is an administrative portion of the DNS namespace. Correct syntax is only the beginning: serial management, delegation, reverse mapping, and authoritative testing determine whether changes work globally.

What you should be able to do after this lesson:

Write SOA, NS, A, AAAA, CNAME, MX, TXT, and PTR records.
Maintain zone serials and TTLs.
Create forward and reverse zones.
Delegate a child zone correctly.
Validate, load, transfer, and query zone data.

Big Idea: A Zone Is Data Plus Delegation

A syntactically valid zone is useful only when resolvers can discover its authoritative servers and those servers return consistent data. Think in three layers:

parent delegation -> authoritative server reachability -> correct zone contents

Testing only the zone file misses parent NS records, glue, firewall paths, and stale secondary copies.

Zone File Structure

$TTL 3600
@ IN SOA ns1.example.test. hostmaster.example.test. (
    2026090801 ; serial
    3600       ; refresh
    900        ; retry
    1209600    ; expire
    300        ; negative cache TTL
)
  IN NS ns1.example.test.
  IN NS ns2.example.test.
ns1 IN A 192.0.2.53
ns2 IN A 192.0.2.54
www IN A 192.0.2.80
mail IN A 192.0.2.25
@ IN MX 10 mail.example.test.

Fully qualified names end with a dot. Without it, the current zone origin is appended.

Important Record Types

A: IPv4 address
AAAA: IPv6 address
CNAME: alias to another canonical name
MX: mail exchanger with preference
NS: authoritative server
TXT: arbitrary text used by many verification and policy systems
PTR: reverse address-to-name mapping
SOA: zone authority and transfer timing

A CNAME owner generally should not have other record data.

Serial Numbers

Secondary servers compare the SOA serial to detect changes. Increase it whenever authoritative zone content changes. A date-based pattern such as YYYYMMDDNN is common but not required; the value must increase using DNS serial arithmetic.

Reverse Zones

For IPv4, reverse names use in-addr.arpa. A /24 example for 192.0.2.0/24 contains records such as:

80 IN PTR www.example.test.

IPv6 reverse DNS uses ip6.arpa and reversed hexadecimal nibbles.

Delegation

The parent zone delegates a child with NS records. If a child nameserver is itself inside the delegated child, the parent also needs glue address records so resolvers can reach it.

Root hints are a special list of root nameserver names and addresses used by recursive resolvers to start discovery. They are not an authoritative zone you normally edit to add local hosts.

Validate and Query

named-checkzone example.test /var/named/example.test.zone
named-compilezone -o example.test.raw example.test example.test.zone
dig @192.0.2.53 example.test SOA
dig @192.0.2.53 example.test AXFR
dig +trace www.example.test
host -t MX example.test 192.0.2.53
nslookup -type=NS example.test 192.0.2.53

named-compilezone can write text or raw master-file formats and validate data before deployment. Zone transfers should be permitted only to authorized secondary servers. Test from the same network position as the secondary.

Guided Practice: Build a Forward and Reverse Pair

Using documentation-only addresses, write a lab forward zone containing:

two NS records
A and AAAA records for both nameservers
one web alias or address record
an MX record and its target address
one TXT record

Write the corresponding reverse PTR record for 192.0.2.80. Increment the serial after every edit, then run:

named-checkzone example.test /var/named/example.test.zone
named-checkzone 2.0.192.in-addr.arpa /var/named/192.0.2.zone

Load the zones only on a lab server. Query the exact server for SOA, NS, A, AAAA, MX, and PTR data. Finally use dig +trace to distinguish local correctness from public delegation.

Troubleshooting Scenario

The primary returns a new A record, but the secondary still serves the old value. Its SOA serial matches the previous version because the administrator edited data without increasing the serial.

Raise the serial, validate the zone, reload the primary, and confirm transfer policy and secondary logs. Restarting clients or lowering their cache TTL cannot make a secondary request content it believes is unchanged.

Exam Focus

Know SOA timing fields, serial handling, and absolute names with trailing dots.
Create forward and reverse data and recognize in-addr.arpa and ip6.arpa.
Understand parent delegation, glue, root hints, and authorized transfers.
Use named-checkzone, named-compilezone, dig, host, and nslookup.

Recap

Trailing dots distinguish absolute from relative names.
Every content update requires a higher SOA serial.
Reverse zones use PTR records under special DNS domains.
Delegation requires correct NS records and sometimes glue.

207.2 Create and maintain DNS zones