How to Look Up a Domain's SOA Record (Serial, Timers and Primary Server)
To look up a domain's SOA record, run dig +short SOA example.com, or nslookup -type=soa example.com on Windows. The answer is one line with seven fields. The bulk SOA record lookup does it for one domain or up to 100 (500 after a free Google sign-in), shows each field and flags timers outside the RFC suggestions.
What is in an SOA record
Every DNS zone has exactly one SOA (Start of Authority) record at its apex, defined in RFC 1035 section 3.3.13.
| Field | Meaning |
|---|---|
| MNAME | The primary name server |
| RNAME | The administrator's mailbox written as a name; the first dot stands for @, so hostmaster.acme.com is hostmaster@acme.com |
| SERIAL | The zone's version number |
| REFRESH | How often secondaries check the primary for a new serial |
| RETRY | How soon a secondary retries after a failure |
| EXPIRE | How long a secondary keeps answering if the primary stays unreachable |
| Negative TTL | How long resolvers may cache that a name does not exist |
Step 1: paste the domains
Paste one domain or a list, one per line. Subdomains are fine, because the zone they sit in is found. Use up to 100 a run, or 500 after a free Google sign-in.
Step 2: run the lookup
Each name gets one SOA query, or up to four when it sits inside a parent zone. The answer comes from a public resolver, not each zone's own servers, so a very fresh change may not show yet.
Step 3: read the result
| Result | What it means |
|---|---|
| Within RFC ranges | The timers fit the suggestions |
| Outside RFC ranges | At least one timer is outside them |
| Timer conflict | Expire is not greater than refresh or retry, or retry is not shorter than refresh |
| No zone found | No SOA was found for the name |
| Lookup failed | DNS did not answer properly |
Which values are recommended
RFC 1912 section 2.2 suggests an expire of 2 to 4 weeks, and says it must be greater than refresh and retry, or a secondary could drop the zone before it gets a new copy. It recommends serials in the YYYYMMDDnn form. RFC 2308 section 5 finds 1 to 3 hours works well for the negative TTL.
Why the negative TTL matters for email
If a resolver looked up selector._domainkey.acme.com before you published the DKIM key, it may keep answering "no such record" until that TTL runs out, so a new record looks missing. Before a mail change, see the DNS TTL change planner. To read other record types in bulk, use the bulk DNS lookup.
Many managed DNS hosts push changes to all their servers directly and use fixed SOA timers of their own. A flag there is worth knowing, not necessarily worth changing.
What this check cannot do
- It reads one public resolver, so fresh changes can lag.
- It does not compare secondary servers, so a secondary stuck on an old serial is not detected.
- The ranges are RFC suggestions, not rules.
- The limit is 100 domains a run without an account and 500 signed in.
Check the addresses you send to
Healthy zones are the base of deliverability; the list is the other half. Upload your list on the verify page: the first 100 email checks are free with a Google sign-in, no card. Each address comes back valid, risky or invalid with a reason, and nothing is sent to anyone on the list. For larger or recurring lists, see bulk email verification, list cleaning and pricing.
Look up your SOA records now
Paste your domains into the bulk SOA record lookup.
Common questions
How do I look up a domain's SOA record?
Run dig +short SOA example.com, or nslookup -type=soa example.com on Windows. A bulk SOA lookup does it for many domains and compares the timers with RFC 1912.
Why does a subdomain have no SOA record?
Most subdomains such as www or mail are records inside the parent zone. The lookup walks up one label at a time and shows the zone it found.
What does the SOA serial mean?
It is the zone's version number. RFC 1912 recommends the YYYYMMDDnn form, for example 2026110501 for the first change on 5 November 2026.
What is the negative caching TTL?
The last SOA timer, from RFC 2308. It says how long a resolver may keep answering that a record does not exist.
Should I change flagged timers?
Not always. Managed DNS hosts often use fixed values on purpose, so a flagged value is worth knowing but not necessarily worth changing.
Check your list before you send
Real mailbox checks over SMTP, and nothing is sent to the address. Sign in with Google and your first 100 email checks are free, no card. Plans for bigger lists are on the pricing page.