SOA Record Lookup

Instantly check a domain's Start of Authority (SOA) record with our free lookup tool - see the primary nameserver, admin email, serial number, refresh, retry, expire, and minimum TTL, plus a live serial-consistency check across every nameserver.

Why Look Up Your SOA Record

The SOA record is the source of truth for your entire DNS zone. If it is misconfigured, secondary nameservers and resolvers can behave unpredictably.

Confirm zone authority

Verify which nameserver is authoritative for your domain and who is listed as the technical contact for the zone.

Diagnose transfer issues

Refresh, retry, and expire control how secondaries sync your zone - bad timers cause stale or dropped DNS data.

Verify recent DNS changes

The serial number increments on every zone edit, so it is a quick way to confirm whether a change has actually saved and propagated.

How to Use the SOA Record Lookup

Running an SOA lookup takes seconds. Follow these three steps to check your zone's Start of Authority record and its nameserver sync.

Enter your domain. Type your root domain (e.g. example.com) - SOA records live at the zone apex, so no subdomain prefix is needed.

Pick a resolver and look up. Choose Google, Cloudflare, OpenDNS, or Quad9, then press Enter or click Look up SOA to query DNS live.

Review every field. Primary nameserver, admin email, serial, refresh, retry, expire, and minimum TTL are parsed and explained - then we compare serials across all your nameservers.

What Is an SOA Record?

The Start of Authority record is a mandatory DNS record at the root of every zone. It names the primary nameserver, the administrative contact, and the timing values that govern how the zone replicates to secondary nameservers.

One per zone

There is exactly one SOA record per zone, created automatically when the zone is set up. You will rarely edit it by hand.

Seven fields

MNAME, RNAME, serial, refresh, retry, expire, and minimum TTL - each with a distinct role in how DNS replication works.

Key for diagnostics

When something in your DNS is not behaving, the SOA record is often the first place to look - especially for zone-sync problems.

yourdomain.com. IN SOA ns1.yourdomain.com. hostmaster.yourdomain.com. (
  2024061801 ; serial
  3600      ; refresh
  900       ; retry
  1209600   ; expire
  3600 )    ; minimum TTL

SOA Record Fields Explained

Every SOA record is made up of seven fields, in this order.

MNAME

Primary nameserver

The hostname of the primary (master) nameserver that holds the original, authoritative copy of the zone.

RNAME

Responsible party's email

The admin email in DNS format - the first dot replaces the @ symbol, so hostmaster.example.com means [email protected].

SERIAL

Serial number

A version number for the zone. It must increase on every edit so secondaries know to pull an update. Commonly formatted YYYYMMDDnn.

REFRESH

Refresh interval

How often (in seconds) a secondary nameserver checks the primary for zone updates.

RETRY

Retry interval

How long (in seconds) a secondary waits before retrying a failed refresh against the primary. Should be shorter than refresh.

EXPIRE

Expire time

How long (in seconds) a secondary keeps serving the zone without reaching the primary before treating its data as stale and stopping.

MINIMUM

Minimum TTL

The default time (in seconds) that negative responses (NXDOMAIN) are cached by resolvers - the negative-caching TTL under RFC 2308.

Common SOA Record Issues and How to Fix Them

Here is what typically goes wrong with an SOA record, and what each result means for your domain.

No SOA record

Zone missing or not delegated

Every zone must have exactly one SOA record. If none is found, the domain is not registered, is not delegated to nameservers, or those nameservers are not answering.

Confirm the domain is registered and its nameservers are set correctly at the registrar.

Retry longer than refresh

Timers in the wrong order

Retry should be shorter than refresh - otherwise a secondary that misses a refresh may wait too long before trying again.

Set retry to a fraction of refresh (e.g. refresh 3600s, retry 900s).

Expire too short

Secondaries drop the zone early

Expire should be much larger than refresh - typically 2 to 4 weeks - to give secondaries enough runway to survive an extended primary outage.

Set expire to around 1209600s (14 days) unless you have a reason not to.

Nameservers out of sync

Serials do not match

If your nameservers report different serial numbers, a secondary is lagging or a zone transfer is failing - visitors may see stale DNS depending on which server answers.

Check zone-transfer (AXFR/IXFR) and NOTIFY between your primary and secondaries.

How to Read the Serial Number

The serial number's only technical requirement is that it increases with every zone change - nameservers use it to detect updates. In practice, almost every DNS provider follows the same YYYYMMDDnn convention: a 4-digit year, 2-digit month, 2-digit day, and a 2-digit revision counter that increments if the zone is edited more than once in a single day.

2024

Year

Month

Day

Revision

2024061801 means the zone was last updated on June 18, 2024, for the first time that day. If you have just made a DNS change and the serial has not moved, your update likely has not saved yet - worth double-checking with your provider before assuming propagation is just slow.

Frequently Asked Questions

Can a domain have more than one SOA record?

No. Every DNS zone has exactly one SOA record by definition. If you appear to see several, you are looking at records from different, unrelated zones or a misconfigured delegation.

Is my domain data sent to your servers?

The domain you enter is sent to our server, which runs the DNS lookup for you against the public resolver you choose - the same query anyone could run with a dig command. We don't log or store the domains you check or the records returned.

Why does the SOA lookup return a different nameserver than my NS records?

This is normal. The MNAME field lists the historical "primary" nameserver, but many providers use hidden primaries or anycast networks where every public-facing nameserver is technically a secondary. Your published NS records are what actually matters for resolution.

What is a healthy refresh / retry / expire configuration?

Common values are refresh 3600s (1 hour), retry 900s (15 min), expire 1209600s (14 days), and minimum 3600s (1 hour). Most managed DNS providers set sensible values automatically - you would typically only tune these on a self-hosted setup.

Does the serial number have to be a date?

No. RFC 1035 only requires a 32-bit unsigned integer that increases on each update. The YYYYMMDDnn date format is just a widely adopted convention because it makes the last-updated date readable at a glance.

What happens if the expire time is reached?

If a secondary nameserver cannot reach the primary for longer than the expire interval, it stops answering authoritatively for the zone entirely, treating its data as too stale to trust. It is a safeguard against serving badly outdated DNS indefinitely.

What does the nameserver serial check tell me?

We query each of your published nameservers directly and compare the serial number they report. When they all match, your zone is in sync. When they differ, a secondary is lagging or a zone transfer is failing - which can cause visitors to see stale DNS depending on which nameserver they hit.

Is the RNAME really an email address?

Yes, formatted as a domain name instead of using the @ symbol - hostmaster.example.com represents [email protected]. Many providers now use a generic placeholder here rather than a monitored inbox.

Automate your email authentication

PowerDMARC monitors your DMARC, SPF, DKIM, BIMI, MTA-STS, and TLS-RPT records in one dashboard - with alerts the moment something breaks.

Book a demo Start 15-day trial