DNS glossary

What is a DNS zone?

A DNS zone is a administrative portion of the domain name space that a single manager controls and publishes as a set of resource records. It begins at a delegated domain name, includes everything below it that has not been delegated elsewhere, and is served by authoritative name servers.

Let's simplify your DDI
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

A DNS zone is an administrative portion of the domain name space managed as a single unit by one manager, beginning at a delegated domain name and served by authoritative name servers. Unlike a domain which represents the entire namespace subtree, a zone is only the part of that subtree that has not been delegated elsewhere, with zones being the fundamental unit of administration in DNS that determines who can change which names and how far errors propagate. Zone design and management directly impact reliability, security, and operational consistency—requiring multiple authoritative servers on separate networks, proper delegation configuration, secure zone transfers, and prevention of common misconfigurations like lame delegations, stale serial numbers, and split-view drift that can cause intermittent resolution failures.

  • A zone is defined by a start of authority (SOA) record and NS records at its apex, distinguishing it as the managed portion of a domain that does not include delegated subdomains, whereas a domain encompasses the entire hierarchical branch including all delegations.
  • Large enterprises running thousands of zones across internal and external views must enforce consistent ownership and naming practices because zone design determines administrative scope and failure boundaries, with RFC 2182 recommending multiple authoritative servers on separate networks to prevent zone unreachability from single points of failure.
  • Common zone misconfigurations such as lame delegations, unincremented SOA serials, missing glue records, open zone transfers, and split-view drift create intermittent resolution failures, data inconsistency, security exposure of internal hostnames, and subdomain takeover vulnerabilities that require TSIG authentication and DNSSEC signing to mitigate.

DNS zone at a glance

AttributeValue
CategoryDNS administrative unit
Defined inRFC 1034 and RFC 1035
Protocol and portDNS, port 53 over UDP and TCP
OSI layerApplication layer (layer 7)
Primary useDelegating and managing authority over part of the DNS namespace
Related termsAuthoritative name server, Zone transfer, Resource record, SOA record, NS record, Delegation

How DNS zone works

A zone is created when a parent zone delegates a domain name to a set of name servers. The zone then holds the records for that name and for any subdomains that are not delegated further.

  1. Delegation: The parent zone publishes NS records that name the servers authoritative for the child domain. This hands administrative responsibility for that part of the namespace to the child zone's manager.
  2. Zone definition: The manager creates a zone file or database entry that begins with a start of authority (SOA) record. It also lists NS records and the other resource records for names in the zone, such as A, AAAA, MX and CNAME.
  3. Publication: One or more authoritative name servers load the zone and answer queries for names inside it with authoritative data.
  4. Replication: Secondary servers copy the zone from a primary server using zone transfers. They compare the serial number in the SOA record to decide whether a newer version exists.
  5. Resolution: A recursive resolver follows delegations from the root downward until it reaches a server authoritative for the zone, then asks that server for the record.

A zone is not the same as a domain. A domain is a subtree of the namespace, while a zone is the part of that subtree managed as one unit, so a domain with delegated subdomains spans several zones. Zone files can also be replaced by database-backed storage without changing how the zone behaves.

Why DNS zone matters in enterprise networks

Zones are the unit of administration in DNS. Each zone has its own records, its own authoritative servers and its own change process, so how an organization divides its namespace into zones determines who can change which names and how far an error spreads. Large enterprises often run thousands of zones across internal and external views, which makes consistent ownership and naming important.

Zone design affects reliability. RFC 2182 recommends that a zone have multiple authoritative servers placed on separate networks so that one failure does not make the zone unreachable. Stale or mismatched NS records, lame delegations, and secondaries that fail to pick up a new SOA serial lead to inconsistent answers and intermittent resolution failures that are hard to trace.

Zones also carry security exposure. A zone transfer returns the full contents of a zone, so servers that allow transfers to any requester reveal internal hostnames and addresses. Restricting transfers to named secondaries, often with transaction signatures, and signing zones with DNSSEC protect against disclosure and tampering. Unmanaged dangling records in a zone can also enable subdomain takeover.

DNS zone vs DNS namespace

The DNS namespace is the entire hierarchical set of domain names, while a zone is one administratively managed portion of that namespace. What is DNS namespace?

DNS zone vs Domain

A domain is a node in the namespace together with everything beneath it, while a zone covers only the part of that domain that has not been delegated to another set of name servers.

AttributeDNS zoneDomain
ScopeNames from the zone apex down to any delegation pointsThe domain name and all names beneath it, including delegated subdomains
Unit ofAdministration and server configurationNaming hierarchy
Defined byA start of authority record and NS records at the apexPosition in the namespace tree
RelationshipA domain can be split across several zonesA zone belongs to exactly one domain apex

Common DNS zone issues

The parent zone lists NS records for servers that do not answer authoritatively for the child zone, often after a server was retired or a zone was never loaded. Resolvers see SERVFAIL or timeouts for some queries, depending on which server they pick.

An administrator edits a zone but leaves the SOA serial unchanged, so secondary servers never see a newer version and do not transfer it. Clients get different answers depending on which authoritative server responds.

A child zone's name servers sit inside the child zone itself, but the parent publishes no glue addresses. Resolvers cannot find the servers, and the whole zone becomes unreachable.

A primary server allows transfers to any requester, so anyone can download every record in the zone and map internal hosts. Restrict transfers to listed secondaries and authenticate them with TSIG.

Internal and external versions of the same zone are edited separately and gradually diverge. Users see different addresses for the same name depending on where they query, which makes troubleshooting slow.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

DNS zone FAQ

Related terms

Article

Authoritative DNS server / Authoritative name server

Provides original and definitive answers to DNS queries.

Learn more
Article

SOA record

A DNS record type that provides important details about a DNS zone; required for every DNS zone.

Learn more
Article

NS record

A DNS record that provides a list of the authoritative name servers responsible for the domain.

Learn more
Article

DNS namespace

Identifies the structure of the domains that combine to form a complete domain name.

Learn more
Article

Fully Qualified Domain Name (FQDN)

A domain name that specifies its exact location in the tree hierarchy of DNS.

Learn more
Article

DNSSEC (Domain Name Service Security Extension)

A mechanism that uses cryptography to provide authentication and integrity for DNS queries.

Learn more
Article

Transaction Signature (TSIG)

A protocol that enables DNS to authenticate updates to a DNS database; most commonly used to update dynamic DNS or a secondary DNS server.

Learn more
Article

Reverse DNS lookup

A tool that requires you to enter an IP address to find the domain name associated with the corresponding IP.

Learn more
Browse the full glossary