OS: Oracle Linux 8.9
Bind version: 9.11.36 (installed from rpm)

I am having trouble creating a subdomain (powerwebappuat.lereta.com) delegated to azure servers. Normally this is not difficult. I would just add a delegation in the data file like this and everyone is happy:

powerwebappuat     IN  NS  ns1-38.azure-dns.com.
powerwebappuat     IN  NS  ns2-38.azure-dns.net.
powerwebappuat     IN  NS  ns3-38.azure-dns.org.
powerwebappuat     IN  NS  ns4-38.azure-dns.info.

This time, however, Micrsoft requires I delegate powerwebappuat with a different SOA than the parent zone. The ticket is very specific:

SOA Records:
Email: azuredns-hostmaster.microsoft.com
Host: ns1-38.azure-dns.com.
Refresh: 3600
Retry: 300
Expire: 2419200
Minimum TTL: 300
Serial number: 1

Current SOA for the parent zone is:

$ORIGIN lereta.com.
$TTL 1200       ; 20 minutes
@     IN SOA  ns1.taxandflood.net. dnsadmin.taxandflood.com. (
         1539796885 ; serial
         3h         ; refresh
         1h         ; retry
         14d        ; expire
         1h         ; minimum

I tried adding a new $ORIGIN with its own SOA:

$ORIGIN powerwebappuat.lereta.com.
$TTL 1200
@ IN  SOA ns1-38.azure-dns.com. azuredns-hostmaster.microsoft.com (
          1           ; serial
          1h          ; refresh
          5m          ; retry
          28d         ; expire
          5m          ; minimum

      NS  ns1-38.azure-dns.com.
      NS  ns2-38.azure-dns.net.
      NS  ns3-38.azure-dns.org.
      NS  ns4-38.azure-dns.info.

While named-checkconf doesn't complain about the above, when I try to sign the zone, named-checkzone return an error which, by design, halts my script.

data/lereta.com:251: SOA record not at top of zone (powerwebappuat.lereta.com)
zone lereta.com/IN: loading from master file data/lereta.com failed: not at top of zone
zone lereta.com/IN: not loaded due to errors.

I can find plenty of examples of delegating subdomains with Bind but none with advice on how to make such a delegation have a different SOA than the parent zone.

Does anyone have an idea how this can be done.

1 Answer 1


Typically I do sub-zones in a separate file. e.g. in named.conf I might have

zone "example.org" {
  type master;
  file "example.org";

zone "subzone.example.org" {
  type master;
  file "subzone.example.org";

Now in the example.org file you can add your delegation:

subzone IN NS ns1.whatever
subzone IN NS ns2.whatever

And in subzone.example.org you can add your SOA

$TTL 1800
subzone.example.org IN SOA ... (
                    IN NS ...
                    IN NS ...
$ORIGIN subzone.example.org.

The subzone can now have any SOA values you want, and named-checkzone can be run on both zones independently.

  • That worked and is more much more elegant than the approach I was trying. Commented Feb 13 at 23:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .