DNS Tool

SOA Lookup

Lookup SOA records to inspect serial, refresh, retry, expire, and default TTL values. Run fast checks, interpret results, and use related tools for validation.

Record Type

SOA

Focused record verification for targeted DNS troubleshooting.

Best Use

Migration + incident checks

Validate live DNS answers during change windows.

Operational Context

Use this page to validate live resolver output during DNS cutovers, outage triage, and post-change verification windows.

SOA Lookup — Start Here

Waiting for input

Enter a domain and run check

How to Use

Use SOA Lookup in 4 Steps

Enter domain

Input the target domain in clean hostname format (no path or query string).

Run SOA Lookup

Execute SOA Lookup to pull live resolver output for this record scope.

Compare expected vs live

Match returned values with your intended DNS configuration at the source.

Cross-check related tools

Validate adjacent DNS layers to isolate cache vs source problems.

What is SOA Lookup?

The SOA (Start of Authority) record is the first record in every DNS zone. It identifies the primary nameserver, the zone admin's email address (encoded as a DNS name), and five timing parameters that govern zone transfers, caching, and negative response behavior.

Every DNS zone has exactly one SOA record. Secondary nameservers compare their stored serial number against the primary's — if the primary's serial is higher, they trigger a zone transfer (AXFR/IXFR) to pull updates. Zone serial format YYYYMMDDNN (date + two-digit sequence) is a widely adopted convention that keeps serials ordered chronologically.

Best Use

Diagnosing zone transfer failures, verifying that serial increments are propagating to secondary servers, and checking negative TTL behavior for NXDOMAIN responses.

Common Mistake

Not incrementing the zone serial after making DNS changes. Secondary servers compare serial numbers to decide whether to transfer updates — an unchanged serial means secondaries keep serving stale data.

Validation Path

Compare the SOA serial across the primary and all secondary nameservers to confirm zone transfers are completing.

Quick Interpretation Table

Use this reference to diagnose common outcomes when running SOA Lookup.

Observed Result	Likely Cause	Next Step
SOA serial not incrementing across nameservers	Zone transfer has not completed	Verify NOTIFY reached secondaries; check transfer logs on secondary servers
MNAME points to unavailable host	Primary NS unreachable for NOTIFY messages	Update MNAME field to the active primary nameserver hostname
MINIMUM (negative TTL) is very high	NXDOMAIN responses cached for too long	Reduce MINIMUM to 300–900s to allow faster DNS updates for new records

CLI Examples

Run these commands directly from a terminal to verify SOA records without relying on a browser-based tool.

dig SOA example.com

Query the SOA record using the default resolver

dig SOA example.com @ns1.example.com

Query SOA directly from the authoritative nameserver — bypasses caching

nslookup -type=SOA example.com

SOA lookup using nslookup (cross-platform)

dig SOA example.com +short

Return just the SOA fields without extra output

Troubleshooting Workflow

Run this record check first for a scoped signal on the target hostname.
Validate nameserver authority and SOA context if results are unexpected.
Use propagation checks when different regions return different values.
Re-run after applying fixes and compare values against your expected configuration.

Frequently Asked Questions

What is a SOA record?

The SOA (Start of Authority) record marks the beginning of a DNS zone and contains: the primary nameserver (MNAME), the admin contact email encoded as a DNS name (RNAME), a serial number for change tracking, and four timing values — REFRESH, RETRY, EXPIRE, and MINIMUM — that govern zone transfer and NXDOMAIN caching behavior.

What is the zone serial number and why does it matter?

The serial number is a 32-bit integer that must increase every time zone data changes. Secondary nameservers compare their copy's serial against the primary — if the primary's serial is higher, they trigger a zone transfer. The widely used format is YYYYMMDDNN (date plus two-digit increment).

What do REFRESH, RETRY, EXPIRE, and MINIMUM mean?

REFRESH: how often secondaries poll the primary for updates (typical: 3600s). RETRY: interval after a failed poll before retrying (typical: 900s). EXPIRE: how long secondaries serve stale data if the primary is unreachable (typical: 604800s / 7 days). MINIMUM: the default negative TTL for NXDOMAIN responses (typical: 300–3600s).

Can a zone have more than one SOA record?

No. RFC 1035 specifies exactly one SOA record per zone. Multiple SOA records indicate a misconfiguration and will cause zone validation failures with DNSSEC and strict resolvers.

Why does the SOA RNAME use dots instead of an @ sign?

DNS encodes the admin email in the RNAME field by replacing the first `@` with a dot. For example, `admin@example.com` becomes `admin.example.com` in RNAME. A literal dot in the local part (before @) is escaped as `\.`. Most DNS management UIs handle this encoding automatically.