SOA Record Lookup

The SOA record marks the top of a zone. RFC 1035 section 3.3.13 defines its seven fields, and a zone file usually writes it across several lines with comments.

example.com.  3600  IN  SOA  ns1.example.com. hostmaster.example.com. (
                              2026091701  ; serial
                              7200        ; refresh (2 hours)
                              3600        ; retry (1 hour)
                              1209600     ; expire (2 weeks)
                              3600 )      ; minimum (negative caching TTL, 1 hour)

An SOA lookup returns all seven fields from each resolver. Our DNS lookup tool asks Google Public DNS (8.8.8.8), Cloudflare (1.1.1.1), Quad9 (9.9.9.9) and OpenDNS at the same time, and if the serial differs between them, some still hold a cached copy from before your last change. The Authoritative option reads the SOA straight from the zone's own nameservers. Like NS records, the SOA exists only at the zone apex.

Open Command Prompt or PowerShell. nslookup ships with every version of Windows, and Resolve-DnsName is the PowerShell cmdlet. Add a resolver address, as in the last two lines, to ask a public resolver instead of your network's.

nslookup -type=SOA example.com
Resolve-DnsName -Type SOA example.com
nslookup -type=SOA example.com 8.8.8.8
Resolve-DnsName -Type SOA example.com -Server 1.1.1.1

macOS ships dig, so no install is needed. Open Terminal and run one of these. The +short form prints only the record values, and the @ form sends the query to a specific resolver.

dig SOA example.com
dig SOA example.com +short
dig @1.1.1.1 SOA example.com

dig and host come from the dnsutils package on Debian and Ubuntu and from bind-utils on Fedora and RHEL. The +noall +answer options print only the answer section, and +tcp forces the query over TCP when you suspect a truncated UDP answer.

dig SOA example.com +noall +answer
host -t SOA example.com

After you change a SOA record, the authoritative nameservers answer with the new value immediately, and every recursive resolver that cached the old record keeps serving it until the cached TTL runs out. Our DNS lookup tool above shows whether Google, Cloudflare, Quad9 and OpenDNS agree yet, and the Authoritative option reads the value straight from the zone's own nameservers. The DNS propagation checker asks resolvers in more locations and lays the results out side by side.

Any 32-bit unsigned number that goes up on every change is valid. RFC 1912 section 2.2 recommends the date form YYYYMMDDnn, where nn counts edits within the day, so 2026091701 is an edit made on 17 September 2026. Many hosted providers use a Unix timestamp or a plain counter instead, and Route 53 shows a fixed serial of 1 because it does not use zone transfers at all.

Comparisons use serial arithmetic (RFC 1982), so the number wraps at 4,294,967,296 and a secondary treats a serial as newer if it is less than 2,147,483,648 ahead of its own. That is also how to fix a serial set too high by mistake: add 2,147,483,647, let every secondary pick it up, then set the correct value.

A secondary loads the zone from the primary named in MNAME. Every REFRESH seconds it queries the primary's SOA and compares the serial with its own copy. If the primary's serial is higher, it starts a zone transfer (AXFR, or the incremental IXFR from RFC 1995). If the query fails, it waits RETRY seconds and tries again. If it has not reached the primary for EXPIRE seconds, it discards the zone and answers SERVFAIL rather than serve stale data.

In practice the refresh interval rarely matters, because RFC 1996 NOTIFY lets the primary announce a change immediately and refresh is only the backstop. Sensible values are a refresh of one to twenty-four hours, a retry shorter than the refresh, and an expire of at least a week.

When a resolver asks for a name that does not exist, the authoritative server answers NXDOMAIN and includes the zone's SOA record in the authority section. RFC 2308 tells the resolver to cache that negative answer for the smaller of the SOA record's own TTL and its MINIMUM field. That is why a subdomain you just added can keep returning NXDOMAIN on a resolver that looked for it a moment earlier.

RFC 2308 recommends one to three hours and warns that values over a day cause problems. Providers that expect frequent additions often set MINIMUM to 300 seconds or less so that a typo in a new hostname does not lock users out for an hour.

Every lookup on DNSX is also a JSON endpoint on api.dnsx.dev that you can call from curl or a script with no API key. The response has one result per resolver with its records and TTLs.

curl https://api.dnsx.dev/dns/soa/wikipedia.org