a DNS zone

The DNS namespace is one huge tree, but no one administers the whole tree at once. Instead it is cut into manageable pieces, and a zone is one such piece — a slice of the tree that a single administration is responsible for. Think of a country divided into provinces: the map of the whole country is one thing, but each province has its own local office that actually keeps the records for the addresses inside it. A zone is that local office's jurisdiction.

Precisely, a zone is the part of the namespace under one node, minus any sub-parts that have been handed off (delegated) to someone else to run as their own zone. For example, example.com is a zone; its administrator keeps the records for www.example.com, mail.example.com, and so on. If they let a separate team run dev.example.com as its own zone, then dev.example.com is delegated out and is no longer part of the example.com zone — the example.com zone simply holds a pointer (NS records) saying who is authoritative for dev.example.com. The actual records of a zone are kept in a zone file or database on its name servers, headed by a special SOA record describing the zone.

Why it matters: zones are how the work and the authority of DNS are divided up, and they explain why the tiny edits you make to your own domain take effect without anyone else's permission — you control your zone. The distinction that trips people up is zone versus domain. A domain is a whole subtree of names; a zone is the administrative unit you actually serve, which is a domain minus its delegated children. They coincide only when nothing below has been delegated away.