Changing default SOA in HestiaCP with DNS cache impact control

If SOA negative TTL is too low, your authoritative server gets repeated NXDOMAIN queries. In HestiaCP defaults, this can be suboptimal for production traffic.

Practical workflow

1. backup current template;
2. patch future-zone generation;
3. validate pilot zone;
4. roll out to existing zones gradually.

cp /usr/local/hestia/func/domain.sh /usr/local/hestia/func/domain.sh.bak.$(date +%F-%H%M)
sed -i 's/ 180 )/ 1800 )/g' /usr/local/hestia/func/domain.sh

Validate zones:

named-checkzone example.com /home/admin/conf/dns/example.com.db
rndc reload

Confirm with dig:

dig +noall +answer SOA example.com

Update persistence

Panel updates may overwrite template files. Keep backup, diff, and post-update checks.

Final takeaway

SOA tuning is easy to implement, but operational rigor is required to keep it consistent and safe over time.

This post is licensed under CC BY-NC.