What is a DNS Zone?
Learn what a DNS zone is, how it differs from a domain, the SOA record, and how zone delegation and transfers work.
Expected Interview Answer
A DNS zone is a distinct, administratively delegated portion of the DNS namespace whose records a specific set of name servers is authoritative for, defined by a zone file that lists the resource records (A, AAAA, MX, NS, CNAME, and others) for that portion of the tree.
A domain like example.com and everything below it is not automatically one zone — the owner can delegate a subdomain like eu.example.com to a different set of name servers, at which point eu.example.com becomes its own zone with its own SOA (Start of Authority) record, while example.com’s zone keeps only an NS record pointing to the delegated servers. Every zone has exactly one SOA record defining the primary name server, the administrator’s email, and timers like refresh, retry, expire, and minimum TTL that control how secondary (slave) servers replicate the zone from the primary via zone transfers (AXFR/IXFR). Zones are the actual unit of delegation and administration in DNS — a name server is described as "authoritative" for a zone, not for a whole domain, which is why a large domain can be split into many independently managed zones. This distinction between the logical domain namespace and the administrative zone boundary is one of the most commonly confused DNS concepts in interviews.
- Defines the unit of administrative delegation within the DNS namespace
- Groups records under one SOA with replication timers for secondaries
- Allows subdomains to be delegated to different name servers as separate zones
- Makes “authoritative for a zone” precise, distinct from “authoritative for a domain”
AI Mentor Explanation
A DNS zone is like a specific ground’s own scorebook, kept and signed off by that ground’s official scorer, covering every match played there — the national board owns the sport overall, but each ground’s scorebook is the authoritative record for what happened on that turf. If a regional academy ground is handed its own scorer and its own book, it becomes its own zone of record even though it is still part of the same national competition. Two scorebooks can reference each other but each is authoritative only for its own ground’s entries. This is exactly how a subdomain delegated to different name servers becomes its own DNS zone with its own authority.
Step-by-Step Explanation
Step 1
Zone file authored
An administrator writes resource records (A, AAAA, MX, NS, etc.) into a zone file for a namespace segment.
Step 2
SOA record set
The zone gets exactly one SOA record defining the primary server, admin contact, and replication timers.
Step 3
Delegation (optional)
A subdomain can be delegated via an NS record to different name servers, creating a new, separate zone.
Step 4
Zone transfer
Secondary servers replicate the zone from the primary via AXFR/IXFR based on the SOA timers.
What Interviewer Expects
- Distinguishes a DNS zone from a DNS domain
- Explains the role of the SOA record and its timers
- Understands zone delegation via NS records for subdomains
- Knows zone transfer (AXFR/IXFR) between primary and secondary servers
Common Mistakes
- Treating “zone” and “domain” as interchangeable terms
- Forgetting a zone has exactly one SOA record
- Not knowing a subdomain can be its own separate zone
- Confusing zone transfer with a regular DNS query/response
Best Answer (HR Friendly)
“A DNS zone is the specific chunk of the domain naming system that a particular set of name servers is responsible for and keeps records for. A big domain isn’t necessarily one zone — parts of it, like a subdomain, can be handed off to a different team’s servers, and that handed-off part becomes its own zone with its own management. It’s the actual unit of delegation and administration in DNS, even though people often use 'domain' loosely to mean the same thing.”
Code Example
# Query the SOA record for a zone
dig +short SOA example.com
# ns1.example.com. admin.example.com. 2026071801 3600 900 1209600 300
# Query the NS records to see which servers are authoritative for the zone
dig +short NS example.com
# Attempt a zone transfer (only succeeds if the server allows AXFR)
dig AXFR example.com @ns1.example.comFollow-up Questions
- What is the difference between a DNS zone and a DNS domain?
- What do the refresh, retry, expire, and minimum TTL fields in an SOA record mean?
- How does zone delegation work when a subdomain is assigned to a different set of name servers?
- What is the difference between AXFR and IXFR zone transfers?
MCQ Practice
1. What record type defines the primary server and replication timers for a DNS zone?
The SOA (Start of Authority) record defines the primary server, admin contact, and replication timers for a zone.
2. A domain and a DNS zone are:
A zone is an administrative delegation boundary; a domain can span multiple zones via subdomain delegation.
3. What mechanism do secondary name servers use to replicate a zone from the primary?
Secondaries pull the zone data from the primary using AXFR (full) or IXFR (incremental) zone transfers.
Flash Cards
What is a DNS zone? — An administratively delegated portion of the DNS namespace that a set of name servers is authoritative for.
Zone vs domain? — A domain can span multiple zones if subdomains are delegated to different name servers.
What record defines zone authority? — The SOA (Start of Authority) record — exactly one per zone.
How do secondaries get zone data? — Via zone transfer (AXFR/IXFR) from the primary server.