Defaults.Exposed › October 2026 census › v10 registry › SOA configuration
SOA configuration
Methodology v10 · canonical ID soa-configuration · DNS (Domain Name System) Security · scored
A correctly configured DNS "start of authority" record.
SOA configuration: definition
| Canonical ID | soa-configuration |
|---|---|
| Category | DNS Security |
| Grade impact | Scored, counts toward the grade |
| Pass | The zone’s SOA record exists with sane timing values (refresh/retry/expire/minimum). |
| Fail | The SOA record is missing or misconfigured. |
| Example (passing) | example.com. IN SOA ns1.example.com. hostmaster.example.com. ( … ) |
SOA configuration across the census
99.0% of domains whose SOA record could be read publish a sane SOA record (324,308,711 of 327,527,446, as of October 12, 2026).
Only a missing or grossly misconfigured SOA fails this check, so a high pass share is expected by construction.
Aggregates only: never an individual domain's result.
How this check is scored
SOA configuration is one of the 24 scored checks in methodology v10. It carries points toward the grade, and a pass earns them. When the result cannot be determined for a domain (a timeout, a SERVFAIL, a redacted source), the check returns N/A and drops out of that domain's scoring denominator. A result that could not be determined is never counted as a fail; a determined absence is.
In the October 2026 census, 4,964,873 of the 332,492,319 graded domains had no determinable result for this check: the SOA record has to be readable before its values can be judged.
Every outcome in the census
| Outcome | Domains | Share of domains whose SOA record could be read | In the headline figure |
|---|---|---|---|
| SOA present with sane timing values | 324,308,711 | 99.0% | Yes |
| SOA missing or misconfigured | 3,218,735 | 0.98% | No |
Source: the October 2026 census rollup, deduplicated per domain, as of October 12, 2026.
Against the other checks
Among the 4 DNS Security checks with a published figure, SOA configuration has the 1st highest pass share. Next below it is Nameserver diversity: 98.9% of domains whose nameserver delegation could be enumerated. Across every check with a published figure it ranks 4th of 24 .
Each share is measured on the check's own base, named on its page, so the ranking compares rates across different sets of domains.
Fix it
Plain-English impact, cost of ignoring it, and step-by-step remediation: How to fix Nameserver setup
Cite this check
Defaults.Exposed, "SOA configuration (soa-configuration)", Grading Methodology v10 (census as of October 12, 2026). https://defaults.exposed/methodology/soa-configuration
Permalink: https://defaults.exposed/methodology/soa-configuration ·
All 33 checks: v10 registry ·
Machine-readable: /methodology/checks.json ·
Licence: open data