SOA Record Lookup - Check DNS Zone Authority

An SOA (Start of Authority) record is a DNS record containing administrative information about a DNS zone. It includes seven fields: the primary nameserver (MNAME), administrator email (RNAME), serial number, refresh interval, retry interval, expire time, and minimum TTL. Every DNS zone must have exactly one SOA record at its apex. The SOA controls how secondary nameservers synchronize with the primary and how long cached data remains valid.

The 7 SOA record fields are: 1) MNAME - primary master nameserver, 2) RNAME - administrator email (stored with . instead of @), 3) Serial - zone version number, 4) Refresh - seconds between sync checks, 5) Retry - seconds between retry attempts, 6) Expire - seconds before zone becomes invalid, 7) Minimum - default/negative cache TTL. Our tool parses all seven fields and displays them in a clear grid layout.

The serial number is a version identifier for the DNS zone. It must increase whenever zone records change. Secondary nameservers compare this number to detect updates—if the primary's serial is higher, they request a zone transfer. Common formats include YYYYMMDDNN (2024011701), Unix timestamps, or simple incrementing numbers. Higher serial always means a more recent zone version.

NS records list ALL authoritative nameservers for a domain (typically 2-6 for redundancy). SOA records contain zone METADATA: the primary nameserver, admin contact, and timing parameters for synchronization. NS tells resolvers where to query; SOA tells those servers how to sync. Both are essential—use NS Lookup to see all nameservers, SOA Lookup for administration details.

These three values control zone transfer timing: Refresh (e.g., 15m) = how often secondary nameservers check the primary for updates. Retry (e.g., 15m) = wait time between attempts if primary is unreachable. Expire (e.g., 7d) = how long secondaries serve cached data if primary stays unreachable. After expire, the zone is considered invalid. Our tool shows these in human-readable format.

In DNS, the @ symbol has a special meaning (zone apex), so SOA records store email addresses with the first dot replacing @. For example, 'admin@example.com' becomes 'admin.example.com' in the RNAME field. Our tool automatically converts this back to standard email format for readability, so you'll see 'admin@example.com' in the results.

In terminal, run: 'nslookup -type=soa example.com' (replace with your domain). This queries your default DNS server for the SOA record. For a specific DNS server, add it at the end: 'nslookup -type=soa example.com 8.8.8.8'. Our web tool provides the same information with human-readable formatting and no command line required.

The Minimum TTL (also called negative TTL) serves two purposes: 1) Default TTL for records that don't specify their own, 2) How long DNS resolvers cache 'not found' (NXDOMAIN) responses. This prevents resolvers from repeatedly querying for non-existent subdomains. Typical values range from 5 minutes to 1 hour.

No—by DNS specification (RFC 1035), each zone must have exactly one SOA record. Having multiple SOA records would cause undefined behavior and likely DNS resolution failures. If you see multiple SOA records, it indicates a serious zone configuration error that needs immediate attention.

Typical refresh intervals range from 15 minutes to 24 hours depending on how frequently your DNS changes. Dynamic environments (frequent updates) benefit from shorter intervals (15-30 minutes) for faster propagation. Stable domains can use longer intervals (6-24 hours) to reduce DNS traffic. Most DNS providers set sensible defaults that work for most use cases.