we configured a primary name server using BIND9 and briefly touched on the zone file — the text file where all of a domain’s DNS records actually live. This article dives deep into zone file formats and resource records, explaining the syntax, every major record type, and how to read, write, and validate zone files confidently on Linux.
Table of Contents
- What Is a Zone File?
- Anatomy of a Zone File
- The SOA (Start of Authority) Record Explained
- The NS (Name Server) Record
- The A and AAAA Records
- The CNAME Record
- The MX Record
- The TXT Record
- The PTR Record (Reverse DNS)
- The SRV Record
- Full Example Zone File
- Reverse Zone Files Explained
- Real-World Example
- Linux Examples: Validating and Querying Zone Files
- Cisco/Network Context
- Python Example: Parsing a Zone File
- Comparison Table of Resource Records
- Best Practices
- Troubleshooting Common Issues
- Conclusion
1. What Is a Zone File?
A zone file is a plain-text configuration file that contains all the DNS records for a specific domain (called a zone) managed by an authoritative name server. It defines everything from the domain’s basic identity information to where its web server, mail server, and other services can be found.
Zone files follow a standardized format defined by the DNS protocol specifications (RFC 1035), and are interpreted by DNS server software like BIND9, ensuring that any correctly formatted zone file works consistently across different DNS server implementations.
2. Anatomy of a Zone File
A zone file consists of directives (lines starting with $, providing instructions to the DNS server) and resource records (the actual DNS data entries). Here is the general structure:
$TTL 604800 ; Directive: default Time To Live for records
@ IN SOA ns1.example.com. admin.example.com. ( ... ) ; SOA record
@ IN NS ns1.example.com. ; NS record
www IN A 203.0.113.10 ; A recordKey symbols and conventions:
@represents the zone’s root domain itself (e.g.,example.com.).- A trailing dot (
.) after a domain name means it is a Fully Qualified Domain Name (FQDN) — an absolute reference. Omitting the trailing dot causes BIND to append the zone’s origin automatically, which is a common source of configuration mistakes. INstands for “Internet” class — virtually always used, since other DNS classes are obsolete.;starts a comment, ignored by the DNS server.
3. The SOA (Start of Authority) Record Explained
Every zone file must begin with exactly one SOA (Start of Authority) record. It defines core administrative information about the zone.
@ IN SOA ns1.example.com. admin.example.com. (
2026072401 ; Serial
3600 ; Refresh
1800 ; Retry
604800 ; Expire
86400 ) ; Minimum TTL (negative caching)Field-by-field breakdown:
| Field | Meaning |
|---|---|
ns1.example.com. | The primary (master) name server for this zone |
admin.example.com. | The zone administrator’s email, with the @ replaced by a . (so admin@example.com becomes admin.example.com.) |
| Serial | A version number for the zone file; must be incremented every time the file is edited so secondary servers know to update |
| Refresh | How often (in seconds) secondary servers should check the primary for updates |
| Retry | How long (in seconds) a secondary should wait before retrying if a refresh attempt fails |
| Expire | How long (in seconds) a secondary should continue answering queries if it cannot reach the primary before considering its data too stale to use |
| Minimum TTL | How long negative responses (“this record doesn’t exist”) should be cached |
A very common convention for the Serial number is the date-based format YYYYMMDDNN (e.g., 2026072401 means “July 24, 2026, first edit of the day”), which makes it easy to know at a glance when the zone was last updated.
4. The NS (Name Server) Record
The NS record declares which name servers are authoritative for a zone. A zone typically has at least two NS records for redundancy.
@ IN NS ns1.example.com.
@ IN NS ns2.example.com.5. The A and AAAA Records
- An A record maps a hostname to an IPv4 address.
- An AAAA record (“quad-A”) maps a hostname to an IPv6 address.
www IN A 203.0.113.10
www IN AAAA 2001:db8::10
mail IN A 203.0.113.116. The CNAME Record
A CNAME (Canonical Name) record creates an alias, pointing one hostname to another hostname (rather than directly to an IP address). The DNS resolver then follows the CNAME to find the actual A/AAAA record.
ftp IN CNAME www.example.com.Important rule: A hostname that has a CNAME record cannot have any other records (like MX or TXT) at the same name — this is a common source of DNS misconfiguration errors.
7. The MX Record
The MX (Mail Exchange) record specifies which mail servers handle email for a domain, along with a priority value (lower numbers are preferred).
@ IN MX 10 mail1.example.com.
@ IN MX 20 mail2.example.com.Here, mail1.example.com (priority 10) is tried first, and mail2.example.com (priority 20) is used as a backup if the first is unreachable.
8. The TXT Record
A TXT record stores arbitrary text data associated with a domain. It’s widely used today for email security (SPF, DKIM, DMARC) and domain ownership verification.
@ IN TXT "v=spf1 include:_spf.example.com ~all"
_dmarc IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"9. The PTR Record (Reverse DNS)
A PTR (Pointer) record does the opposite of an A record — it maps an IP address back to a hostname, used for reverse DNS lookups. PTR records live in special reverse zone files (explained in Section 12).
10 IN PTR www.example.com.10. The SRV Record
A SRV (Service) record specifies the location (hostname and port) of specific services, commonly used by protocols like SIP (VoIP) or Microsoft Active Directory.
_sip._tcp IN SRV 10 60 5060 sipserver.example.com.Format: priority weight port target.
11. Full Example Zone File
Here is a complete, realistic forward zone file for example.com, combining everything covered so far:
$TTL 604800
@ IN SOA ns1.example.com. admin.example.com. (
2026072401 ; Serial
3600 ; Refresh
1800 ; Retry
604800 ; Expire
86400 ) ; Minimum TTL
; Name servers
@ IN NS ns1.example.com.
@ IN NS ns2.example.com.
; A records
ns1 IN A 203.0.113.10
ns2 IN A 203.0.113.11
www IN A 203.0.113.12
mail IN A 203.0.113.13
; AAAA record
www IN AAAA 2001:db8::12
; CNAME record
ftp IN CNAME www.example.com.
; MX records
@ IN MX 10 mail.example.com.
; TXT records (SPF)
@ IN TXT "v=spf1 include:_spf.example.com ~all"12. Reverse Zone Files Explained
While a forward zone answers “what IP address does this name have?”, a reverse zone answers the opposite: “what name does this IP address have?” Reverse zones use a special domain suffix — .in-addr.arpa for IPv4 — with the IP address octets reversed.
For the network 203.0.113.0/24, the reverse zone would be named:
113.0.203.in-addr.arpaExample reverse zone file:
$TTL 604800
@ IN SOA ns1.example.com. admin.example.com. (
2026072401
3600
1800
604800
86400 )
@ IN NS ns1.example.com.
10 IN PTR www.example.com.
11 IN PTR mail.example.com.Here, 10 and 11 correspond to the last octet of 203.0.113.10 and 203.0.113.11 respectively — BIND automatically appends the reverse zone suffix.
13. Real-World Example
An e-commerce company runs shop.example.com. Their DNS setup includes:
- An A record pointing
shop.example.comto their web server’s IP. - An MX record directing email to their mail provider (e.g., Google Workspace).
- A TXT record (SPF) authorizing that mail provider to send email on their behalf, reducing the chance their emails are marked as spam.
- A CNAME record for
www.shop.example.compointing toshop.example.com, so both URLs work. - A PTR record configured by their hosting provider so that outbound mail servers pass reverse DNS checks — many receiving mail servers reject email from IPs without valid PTR records, as a basic spam-fighting measure.
14. Linux Examples: Validating and Querying Zone Files
Validate a zone file’s syntax before deploying it:
sudo named-checkzone example.com /etc/bind/zones/db.example.comSample successful output:
zone example.com/IN: loaded serial 2026072401
OKQuery specific record types using dig:
dig example.com SOA
dig example.com NS
dig www.example.com A
dig example.com MX
dig example.com TXTPerform a reverse DNS lookup:
dig -x 203.0.113.10View all records for a domain in one query (where supported):
dig example.com ANY15. Cisco/Network Context
Reverse DNS (PTR records) is especially important in enterprise networks using Cisco infrastructure, since many network monitoring and logging tools (like Cisco NetFlow analyzers or syslog servers) display hostnames instead of raw IPs when reverse DNS is properly configured, making logs far easier to read.
Configuring a Cisco device to perform reverse DNS lookups in logs:
Router(config)# ip domain-lookup
Router(config)# ip name-server 203.0.113.10With this configured, commands like show logging will attempt to resolve IP addresses to hostnames using your PTR records, wherever reverse DNS zones have been properly set up.
16. Python Example: Parsing a Zone File
The following Python script performs a simple parse of a zone file, extracting and categorizing each resource record type — a simplified illustration of what DNS server software does internally when loading a zone.
import re
zone_file_content = """
$TTL 604800
@ IN SOA ns1.example.com. admin.example.com. (2026072401 3600 1800 604800 86400)
@ IN NS ns1.example.com.
www IN A 203.0.113.12
ftp IN CNAME www.example.com.
@ IN MX 10 mail.example.com.
@ IN TXT "v=spf1 include:_spf.example.com ~all"
"""
record_pattern = re.compile(r"^(\S+)\s+IN\s+(SOA|NS|A|AAAA|CNAME|MX|TXT|PTR)\s+(.*)$", re.MULTILINE)
records_by_type = {}
for match in record_pattern.finditer(zone_file_content):
name, record_type, value = match.groups()
records_by_type.setdefault(record_type, []).append((name, value.strip()))
for record_type, entries in records_by_type.items():
print(f"\n--- {record_type} Records ---")
for name, value in entries:
print(f"{name:8s} -> {value}")Sample Output:
--- SOA Records ---
@ -> ns1.example.com. admin.example.com. (2026072401 3600 1800 604800 86400)
--- NS Records ---
@ -> ns1.example.com.
--- A Records ---
www -> 203.0.113.12
--- CNAME Records ---
ftp -> www.example.com.
--- MX Records ---
@ -> 10 mail.example.com.
--- TXT Records ---
@ -> "v=spf1 include:_spf.example.com ~all"
17. Comparison Table of Resource Records
| Record Type | Purpose | Example |
|---|---|---|
| SOA | Zone authority and administrative metadata | @ IN SOA ns1.example.com. admin.example.com. (...) |
| NS | Declares authoritative name servers | @ IN NS ns1.example.com. |
| A | Maps hostname to IPv4 address | www IN A 203.0.113.10 |
| AAAA | Maps hostname to IPv6 address | www IN AAAA 2001:db8::10 |
| CNAME | Aliases one hostname to another | ftp IN CNAME www.example.com. |
| MX | Directs email to mail servers | @ IN MX 10 mail.example.com. |
| TXT | Arbitrary text (SPF, DKIM, verification) | @ IN TXT "v=spf1 ..." |
| PTR | Maps IP address back to hostname (reverse DNS) | 10 IN PTR www.example.com. |
| SRV | Locates specific network services | _sip._tcp IN SRV 10 60 5060 sip.example.com. |
18. Best Practices
- Always increment the Serial number after any zone file edit, using a consistent format like
YYYYMMDDNN. - Use trailing dots correctly on FQDNs — a missing dot is one of the most common and confusing zone file errors.
- Never place other records at a name that already has a CNAME record — this violates DNS standards and causes unpredictable resolution behavior.
- Configure PTR records for any server sending outbound email, since many mail servers reject messages from IPs lacking valid reverse DNS.
- Validate every zone file with
named-checkzonebefore reloading the DNS server, catching syntax errors before they cause an outage. - Keep TTLs reasonable — very short TTLs increase query load; very long TTLs slow down propagation of legitimate changes.
19. Troubleshooting Common Issues
| Issue | Cause | Fix |
|---|---|---|
| “dns_master_load: zone example.com/IN: … not in zone” | A record’s name doesn’t end in the zone’s domain correctly, often a missing trailing dot | Add the trailing dot to FQDNs, or remove it if referencing a name within the zone |
| Secondary server not updating | Serial number wasn’t incremented after edits | Increment Serial and reload the zone |
| Emails from your domain marked as spam | Missing or misconfigured SPF/DKIM/DMARC TXT records, or missing PTR record | Add proper TXT records, request PTR record configuration from your hosting/ISP provider |
dig shows “NXDOMAIN” for a record you just added | Zone file wasn’t reloaded, or syntax error prevented loading | Run named-checkzone, then systemctl restart bind9 |
| CNAME conflicts | Another record exists at the same name as a CNAME | Remove the conflicting record or restructure using a different subdomain |
Diagnostic sequence for zone file issues:
sudo named-checkzone example.com /etc/bind/zones/db.example.com # Validate syntax
sudo systemctl restart bind9 # Reload
dig @localhost example.com SOA # Confirm serial number updated
journalctl -u bind9 --since "10 minutes ago" # Check recent logs for errors20. Conclusion
Zone files are the heart of the DNS system — structured text files containing resource records like SOA, NS, A, AAAA, CNAME, MX, TXT, and PTR that together define how a domain resolves and behaves across the internet. Understanding the precise syntax and purpose of each record type, correctly managing Serial numbers, and validating your work with tools like named-checkzone are essential skills for anyone responsible for DNS infrastructure — whether managing a single personal domain or an enterprise-scale network.
