Free SOA lookup – check the Start of Authority record
SOA Lookup
Free, no sign-up. We only fetch the public URL you enter.
Short answer
Enter a domain above – for example example.com – and the SOA lookup queries DNS for the Start of Authority record and shows every field with its TTL: primary nameserver (MNAME), responsible email (RNAME), serial, refresh, retry, expire and the negative-caching minimum. If the primary nameserver does not belong to the provider where you edit records, you are editing the wrong zone. monitordefend does not monitor DNS records, but its uptime check emails you when a DNS mistake takes your website offline.
- Free, no sign-up: all seven SOA fields plus the record TTL.
- Primary NS shows which provider is authoritative for the zone.
- Serial, refresh, retry and expire explain zone sync behaviour.
Primary NS (MNAME) ns1.dnsprovider.example Responsible (RNAME) hostmaster.myshop.com Serial 2026101602 Refresh 7200 Retry 3600 Expire 1209600 Minimum TTL 300
With this free SOA lookup you read the Start of Authority record of any domain in seconds. The SOA record is the header of a DNS zone: it names the primary nameserver, the responsible contact, the serial number that versions the zone and the timers that keep secondary nameservers in sync. Checking it tells you which provider is really authoritative for a domain, whether a change has been published and how the zone is meant to behave when something fails.
How does the SOA lookup work?
Type a domain name such as example.com into the field and start the check. The tool sends a DNS query for the record type SOA and returns the answer it receives, split into its individual fields, together with the TTL – the time-to-live that tells resolvers how long they may cache this answer before asking again.
Because the SOA record sits at the apex of a zone, you normally query the bare domain, not www or another subdomain. If you enter a subdomain that is not a zone of its own, DNS typically answers with the SOA of the parent zone in the authority section, which is still useful: it tells you which zone the name belongs to.
What is an SOA record?
SOA stands for Start of Authority. It is the first and mandatory record of every DNS zone and acts as its header. Where an A record answers “which IP does this name have?”, the SOA record answers “who is in charge of this zone, which version is current and how should other servers handle it?”.
The record was designed for the classic setup in which one primary nameserver holds the master copy of a zone and one or more secondary nameservers copy it through zone transfers. The serial number and the three timers exist so that secondaries know when to fetch a new copy and what to do when the primary cannot be reached. Modern cloud DNS services often replicate zones differently, but the SOA record is still part of every standards-conforming zone.
What do the SOA fields mean?
The lookup shows seven values. Reading them in order gives you a quick profile of how a zone is run and by whom.
- Primary NS (MNAME): the main authoritative nameserver for the zone, usually a host of your DNS provider.
- Responsible email (RNAME): the contact mailbox, written with a dot instead of the @ – hostmaster.example.com means hostmaster@example.com.
- Serial: the version number of the zone; it must increase with every change so secondaries notice it.
- Refresh: how often a secondary asks the primary whether the serial has changed.
- Retry: how long a secondary waits before trying again after a failed refresh.
- Expire: after how long without a successful refresh a secondary stops answering for the zone.
- Minimum: today used as the negative-caching TTL – how long resolvers remember that a name does not exist.
When should you check an SOA record?
The SOA lookup is a troubleshooting tool for moments when DNS behaves differently than expected. It answers basic questions about the zone before you dig into individual records.
- When troubleshooting DNS zone issues after changes that do not seem to take effect.
- When migrating DNS providers and validating which zone is now authoritative.
- When confirming that an update has been published, by comparing the serial number.
- When debugging secondary DNS sync, zone transfers or propagation behaviour.
- When a newly created record returns “does not exist” for longer than expected.
Using the primary nameserver to find the right DNS provider
One of the most common DNS mistakes is editing records at a provider that is no longer authoritative – for example at the registrar’s default DNS while the domain was long ago delegated to a CDN or a hosting company. The change is saved, the panel shows it, yet nothing happens on the internet.
- Edit Record changed on the primary
- Serial +1 Zone gets a new version
- Refresh Secondary compares serials
- Transfer Secondary pulls the new zone
The MNAME field reveals this quickly. If the primary nameserver in the SOA output belongs to a different provider than the one where you are making changes, you are almost certainly editing the wrong place. Compare it with the NS records of the domain as well: both should point to the same DNS service.
The serial number and why it sometimes does not change
In a traditional zone file the administrator raises the serial after every edit. A widespread convention is the date format YYYYMMDDnn – 2026101602 means the second change on 16 October 2026. Secondaries compare their serial with the primary’s at every refresh and transfer the zone only when the primary’s number is higher.
Many managed DNS platforms work differently. They propagate changes through their own internal systems, so the serial may stay constant, follow a timestamp or change for reasons unrelated to your edit. If your serial does not move after an update, that is not automatically an error – check the record you changed directly instead.
Refresh, retry and expire: sensible values
The three timers only matter when secondaries pull the zone from a primary. Refresh is commonly set between one and twenty-four hours, retry to a fraction of the refresh value, and expire much longer. Guidance often cited from RFC 1912 suggests an expire window of roughly two to four weeks, so secondaries keep answering through a long primary outage but do not serve stale data forever.
An expire value that is too short is the dangerous one: if the primary fails over a weekend, secondaries can stop answering and the whole domain disappears. An expire that is extremely long keeps outdated records alive after a broken setup. The minimum field, used for negative caching, is usually a few minutes to an hour; very high values make freshly created names take long to appear.
Why different tools show different SOA records
It is common to see a slightly different SOA in two tools. Some query public resolvers that answer from their cache, while others ask the authoritative nameservers directly. During a change or within a caching window, the cached copy may still carry an older serial.
Anycast DNS networks add another layer: individual nodes can briefly lag behind each other, so two queries a minute apart may return different serials. If the values converge after the TTL has passed, everything is fine. If one nameserver keeps an old serial for hours, a secondary is not syncing and needs attention.
SOA and monitordefend
monitordefend is a hosted website monitoring service and does not watch DNS records or SOA serials. Use this free lookup whenever you change a zone or move providers. What monitordefend notices is the effect of a broken zone: if your domain stops resolving, its uptime check fails, a second attempt confirms the outage and you get an email.
Frequently asked questions
What does SOA stand for in DNS?
SOA stands for Start of Authority. It is the record that describes the source of truth for a DNS zone: which nameserver is primary, who is responsible and how the zone is versioned and synchronised.
Does every domain have an SOA record?
Every properly configured DNS zone has exactly one SOA record at its apex. A zone without one does not conform to the DNS standard, and many resolvers will treat it as broken.
How can an SOA lookup help me confirm I am editing the right DNS provider?
Look at the primary nameserver (MNAME). If it belongs to a different company than the panel where you edit records, you are probably not changing the authoritative zone.
Why do different tools show different SOA records for the same domain?
Some tools ask caching resolvers, others query the authoritative nameservers. During changes and within TTL windows, the cached and the live answer can differ for a while.
Why is my SOA serial not changing after I update DNS records?
Many cloud DNS providers do not rely on classic zone transfers, so they do not raise the serial for every edit. Check the changed record itself to confirm the update.
What do SOA refresh, retry and expire mean?
They are timers for secondary nameservers: how often to check for updates (refresh), how soon to try again after a failure (retry) and when to stop serving the zone if no update succeeds (expire).
How do I look up an SOA record on the command line?
Run “dig example.com SOA” on macOS or Linux, or “nslookup -type=soa example.com” on Windows. Add “@” and a nameserver to dig to ask the authoritative server directly instead of your resolver.
What is a reasonable SOA expire value?
Common guidance suggests around 14 to 28 days, which bridges long primary outages without serving outdated data indefinitely.