Free tool
Inspect a domain's Start of Authority record: primary nameserver, serial, and refresh timers.
Enter a domain to look up its SOA records.
The SOA (Start of Authority) record holds administrative metadata for a DNS zone: the primary nameserver, the zone administrator's email, a serial number that increments on every change, and the timers that govern how secondary servers refresh.
Checking the serial number is a quick way to confirm a zone change has been published. This tool shows every SOA field for a domain.
In a zone file the SOA is usually spread over several lines, with a comment naming each timer:
example.com. 3600 IN SOA ns1.example.net. hostmaster.example.com. (
2026101601 ; serial
7200 ; refresh
3600 ; retry
1209600 ; expire
3600 ) ; minimum TTL
The first name is the primary nameserver. The second is the zone administrator's email address with the @ replaced by a dot, so hostmaster.example.com means hostmaster@example.com.
The serial must increase every time the zone changes. A common convention is YYYYMMDDnn, the date plus a two-digit counter, so 2026101601 is the first change on 16 October 2026. Some providers use a Unix timestamp or a plain counter instead; all that matters is that it goes up.
The timers are in seconds. Refresh is how often secondary nameservers ask the primary whether the serial has changed. Retry is how long they wait before asking again after a failed attempt. Expire is how long a secondary keeps answering without reaching the primary before it gives up on the zone. The minimum TTL now sets how long resolvers may cache a negative answer, such as a name that does not exist (RFC 2308).
The tool shows seven fields: Primary NS, Hostmaster, Serial, Refresh, Retry, Expire and Minimum TTL. The four timers are shown in seconds; 3600 is an hour, 86400 a day and 604800 a week. The serial is shown exactly as published, for example 2026101601. The bar above shows one record and the query time.
The answer comes from Google Public DNS (8.8.8.8), with Cloudflare (1.1.1.1) as the fallback, asked live from the PulseStack™ server in the UK, and nothing is stored. Because it comes through a public resolver, it can be a cached copy up to the SOA's own TTL old. If you have just made a change and the serial has not moved, ask a nameserver directly, as shown below, or use the DNS propagation checker to see which resolvers return the changed record.
Primary NS is the server the zone names as its master copy. With hosted DNS, where every nameserver serves the same data, it is often just the first of the provider's nameservers. No SOA records found usually means you entered a name below the top of the zone, such as www.example.com (look up example.com instead), or a domain that does not resolve.
Serial not increased after an edit. On self-managed servers such as BIND, secondaries only fetch the zone when the serial goes up, so they keep serving the old data. Hosted DNS providers normally update the serial for you.
Nameservers out of step. One secondary has not picked up the latest zone, so resolvers get different answers depending on which server they ask. Compare the serial on each nameserver with the commands below.
Expire set too short. If the primary is unreachable for longer than the expire time, secondaries stop answering and the domain disappears. RFC 1912 suggests two to four weeks, which is 1209600 to 2419200 seconds.
A long minimum TTL. When you add a new name, resolvers that recently asked for it and were told it did not exist keep that answer for the negative caching time, so the new record can seem missing for a while. Keep it modest: RFC 2308 suggests one to three hours.
A hostmaster address nobody reads. It is the published contact for the zone, so point it at a mailbox that is monitored.
On macOS or Linux, run dig SOA example.com +short. On Windows, use nslookup -type=SOA example.com, or in PowerShell Resolve-DnsName -Name example.com -Type SOA.
dig +nssearch example.com asks every authoritative nameserver for its SOA and prints each serial, the quickest way to spot a server that is behind. To ask one server directly, bypassing caches, add it to the query, for example dig SOA example.com @ns1.example.net, using a name from the nameserver lookup.
The DNS lookup shows the SOA alongside a domain's other records. To be alerted when a record that matters changes, PulseStack™ DNS monitoring watches A, AAAA, MX, CNAME, TXT and NS records on paid plans.
The serial increments each time the zone changes. Secondary nameservers compare it against their cached copy to decide whether to pull an update. If the serial did not change, your edit has not been published yet.
They control secondary nameserver behaviour: refresh is how often to check for updates, retry is how long to wait after a failed check, and expire is how long a secondary keeps serving data if it cannot reach the primary.
Yes. A valid DNS zone has exactly one SOA record, at its apex. Your DNS provider creates it automatically when you set up the zone.
It depends on where your DNS is hosted. Many hosted DNS services manage the SOA for you and let you change only some fields, such as the timers or the hostmaster address, or none at all. On your own DNS server you edit it like any other record, remembering to raise the serial each time.
Every one runs a real check, live, with nothing to install.
PulseStack™ DNS record monitors check A, AAAA, MX, CNAME, TXT and NS records as often as every five minutes and alert you when the value you expect disappears. Included from the Starter plan at £9 a month, with a 14-day trial and no card.