--- title: Free SOA Record Lookup description: Inspect a zone's Start of Authority record — primary nameserver, admin contact, serial number and the refresh, retry, expire and minimum timers. Compare serials across servers to prove a zone transfer happened, and read the negative-caching TTL that decides how long an NXDOMAIN sticks. canonical: https://watchfor.io/soa-record-lookup --- [Back to all free tools](/free-tools) # SOA Record Lookup Inspect a zone's Start of Authority record — primary nameserver, admin contact, serial number and the refresh, retry, expire and minimum timers. Compare serials across servers to prove a zone transfer happened, and read the negative-caching TTL that decides how long an NXDOMAIN sticks. Result No result yet Enter the inputs above and press Run. Results appear here in a moment. Monitor this 24/7 — get alerts on the first failure. [Start free](/auth/sign-up) Only run these tools against systems you own or are authorized to test. Using them to scan or probe systems without permission violates our [Terms](/legal/terms). ## What is SOA Record Lookup ? The SOA (Start of Authority) record is the zone's identity card. Every zone has exactly one, at its apex, and it names the primary nameserver, the responsible party's email, and five numbers that govern how the zone is copied and cached: the serial, and the refresh, retry, expire and minimum (negative-caching) timers. Nothing on a website reads it — but every secondary nameserver, every resolver caching an NXDOMAIN , and every DNSSEC validator does. This tool returns the SOA record of any zone from the resolver or nameserver you choose. Compare serials across your nameservers to prove a change was transferred to all of them, read the negative TTL to know how long a missing record stays missing in caches, and see which server the zone considers primary. ## How it works One record, seven fields, two useful comparisons: - 1 Query `QTYPE=SOA` for the zone apex — Querying a subdomain that isn't a zone of its own returns the parent zone's SOA in the authority section — a quick way to find where a name's zone actually starts. - 2 Read the fields — MNAME (primary server), RNAME (contact, with the @ written as a dot), then serial, refresh, retry, expire and minimum, all in seconds except the serial. - 3 Compare across servers — Point the resolver field at each authoritative nameserver in turn. Identical serials mean they hold the same zone version; a lagging serial means that server hasn't received the latest transfer. Managed DNS providers often synthesise the SOA (serial as a Unix timestamp, generic contact); the timers still tell you how their caches and secondaries behave. ## When you'd use it ### Confirming a zone transfer You changed a record on the primary; a secondary still serves the old one. Their SOA serials differ. Either the NOTIFY didn't reach the secondary, or it hasn't hit its refresh interval yet. ### Understanding negative caching You added a record that didn't exist before, and some resolvers keep saying NXDOMAIN . The SOA's minimum field (RFC 2308 negative TTL) is how long they'll do that. A large value there makes every new record slow to appear. ### Finding the zone boundary Is eu.app.example.com in its own zone or in example.com 's? The SOA in the answer or authority section names the zone it belongs to, which decides where to edit. ### Contacting the zone owner RNAME is the technical contact for the zone ( hostmaster.example.com = hostmaster@example.com ). Often a generic mailbox, occasionally the only one that works. ## Reading the result ### Serial A version number for the zone. Secondaries pull a new copy only when the primary's serial is higher. Conventions: YYYYMMDDnn or a Unix timestamp. A serial that goes down (after a restore, or a provider migration) freezes secondaries until it's bumped past the old value. ### Refresh / Retry / Expire How often a secondary checks the primary's serial, how soon it retries after a failed check, and how long it keeps serving the zone if the primary stays unreachable. Typical: 3600 / 600 / 604800 or more. Expire is the safety net that keeps a zone alive through a primary outage. ### Minimum (negative TTL) Since RFC 2308, how long resolvers cache a NXDOMAIN or empty answer. 300–3600 is common; anything larger delays every new record's first appearance. ### MNAME The primary nameserver, where dynamic updates and NOTIFYs originate. It doesn't have to be in the NS set (a hidden primary), which is why it sometimes names a server you can't query. ## Check it yourself dig SOA example.com @1.1.1.1 +noall +answer dig SOA example.com @ns1.example.com +short on each nameserver, then compare the third field (the serial). ## Common pitfalls ### Serial not incremented Editing a zone file by hand without bumping the serial: the primary serves the new data, the secondaries never notice. Provider dashboards handle this for you; hand-managed BIND zones don't. ### Serial goes backwards after a migration The new provider starts its serial at 1 or a timestamp lower than the old 2026091201 . Secondaries and some resolvers consider the old zone newer. Set the serial higher than the old one, or use the RFC 1982 wrap trick. ### Reading the minimum field as the default TTL It was, before RFC 2308 (1998). Today it is the negative-caching TTL only; each record's own TTL is set per record or via $TTL . ## Run SOA Record Lookup on every change, not just once. Get alerts the moment something breaks — across HTTP, DNS, SSL, RDAP, ping, blacklist and more. Free forever for 10 monitors. No card. [Start free](/auth/sign-up) ## Frequently asked questions What do the SOA numbers mean? In order: serial (zone version), refresh (seconds between a secondary's checks), retry (seconds before retrying a failed check), expire (seconds a secondary keeps serving without contact), minimum (seconds resolvers cache negative answers). Why does my SOA email address look wrong? The first dot stands for @ : hostmaster.example.com. is hostmaster@example.com . A mailbox with a dot in the local part must escape it: john\.doe.example.com. Does a subdomain have its own SOA? Only if it was delegated as its own zone (it has NS records in the parent). Otherwise it is just a name inside the parent zone and shares its SOA. How long does NXDOMAIN stay cached? The lesser of the SOA's minimum field and the SOA record's own TTL, per RFC 2308. Adding a record that resolvers have already cached as missing waits that long. Why do the nameservers show different serials? A transfer is pending or failing. Check that the primary allows AXFR/IXFR from each secondary and that NOTIFY reaches them; otherwise the secondary catches up at its next refresh. ## Related dns tools - [DNS LookupResolve A, AAAA, MX, TXT, NS, SOA, CNAME, PTR, CAA, SRV records for any domain.](/dns-checker) - [DNS PropagationCheck how a DNS record looks from every prober region simultaneously — spot stale anycast nodes and propagation gaps on a world map.](/dns-propagation-checker) - [Whois LookupModern RDAP-based domain registration lookup: registrar, expiry, nameservers, status flags.](/whois-lookup) - [A Record LookupFind the IPv4 address a domain resolves to — every A record with its TTL, from the resolver of your choice. Spot a stale IP after a migration, a missing record behind a 'site can't be reached', or a round-robin set that is one address short.](/a-record-lookup) --- Canonical page: https://watchfor.io/soa-record-lookup · Site guide: https://watchfor.io/llms.txt