---
title: "What is a DNS zone file?"
canonical: https://enum.co/learn/what-is-a-dns-zone-file
locale: en
topic: Network
publishedAt: 2026-10-19
updatedAt: 2026-10-19
author: "Max Heyer"
summary: "A DNS zone file is a plain text file that lists every record of a DNS zone, in a standard format nameservers load and providers import and export."
---

# What is a DNS zone file?

A DNS zone file is a plain text file that lists every record of a DNS zone, in a standard format nameservers load and providers import and export.

After reading this you will be able to:

- Read the SOA, NS and other records in a zone file
- Explain what $ORIGIN, $TTL and the @ sign do
- Move a zone between providers with an export and import

## What is a DNS zone file?

A DNS zone file is a plain text file that holds all resource records of one DNS zone, one record per entry. Authoritative nameservers load it to answer queries for the domain. The format is defined in the DNS standard as the master file format, often called the BIND format, and most DNS providers can import and export it.

Think of it as the address book for one company. Each line maps a name to where it lives, and the whole book is the one place that holds the answers.

## What is inside a zone file?

A zone has exactly one SOA record at its top, usually followed by the NS records and then the rest of the zone. A short example:

```
$ORIGIN example.com.
$TTL 3600
@     IN SOA ns1.example.com. hostmaster.example.com. (
          2026102201 ; serial
          7200       ; refresh
          3600       ; retry
          1209600    ; expire
          300 )      ; negative caching TTL
      IN NS  ns1.example.com.
      IN MX  10 mail
ns1   IN A   203.0.113.53
www   300 IN A 203.0.113.10
mail  IN A   203.0.113.20
```

### Directives

$ORIGIN sets the domain that relative names are appended to. $TTL sets the TTL for every record that does not state its own. $INCLUDE pulls another file into the zone.

### Names and the @ sign

A name ending in a dot is absolute, so "ns1.example.com." is complete. A name without the dot is relative, so "mail" becomes mail.example.com. The @ sign stands for the origin itself, and a line that starts with a blank reuses the previous owner name.

### The SOA record

The SOA names the primary nameserver and the mailbox of whoever runs the zone, with a dot in place of the @. Its serial is the zone version, and refresh and retry tell secondary servers how often to check for changes. Expire is how long a secondary keeps answering when it cannot reach the primary, and the last field sets how long resolvers cache a "no such name" answer.

## What are zone files used for?

- Moving a zone from one DNS provider to another without retyping records.
- Keeping a backup or a reviewed copy of the zone in version control.
- Loading a zone into nameserver software directly.

A semicolon starts a comment, and parentheses let one record span several lines, as the SOA above does.

## How enum handles DNS zone files

[enum DNS](/dns) imports BIND zone files in merge, replace or prune mode, with a dry run first to preview the changes. enum manages the SOA and apex NS records itself and ignores them in the file. You can export a zone back to a BIND zone file at any time, and DNS is free for every enum account.

## FAQ

**Do I need to edit the SOA serial by hand?**
Only when you run your own nameservers from the file. Secondaries compare serials to decide whether to transfer the zone again. On a hosted DNS service the provider manages the SOA for you.

**What happens if a zone file has an error?**
Nameserver software checks the file when it loads it and can reject the whole zone over one bad line. Check the file before loading it, or run an import as a dry run first to see what would change.

**Does a zone file include DNSSEC keys?**
A signed zone file can hold DNSKEY and signature records, but providers with online signing create those themselves. You publish the DS record or DNSKEY they return at your registrar instead.