SOA Record Lookup

What the SOA record is

Every DNS zone has exactly one SOA (start of authority) record, at its apex. It names the primary nameserver, gives a contact mailbox, carries the serial number that identifies the version of the zone, and sets four timers that control how secondary nameservers copy the zone and how long resolvers remember that a name does not exist. If you enter a name below the zone apex, this lookup climbs to the zone the name belongs to and shows that zone's SOA.

The serial number and zone copies

Secondary nameservers keep a copy of the zone. Every refresh interval, or sooner when the primary sends a NOTIFY, they compare the primary's serial with their own and transfer the zone when it is higher. So the serial must go up with every change. Many people use the date format YYYYMMDDnn, for example 2026111001 for the first change on 10 November 2026; managed DNS providers often use their own scheme, which is just as valid. A serial that was lowered, or not raised after an edit, leaves secondaries serving the old zone. Serial comparison wraps around (RFC 1982), so lowering one on purpose takes special steps.

The timers in plain terms

Refresh is how often a secondary asks whether the serial changed. Retry is how long it waits after a failed attempt before asking again, and should be shorter than refresh. Expire is how long a secondary keeps answering for the zone when it cannot reach the primary at all; after that it stops answering rather than serve data that may be outdated, so it should comfortably outlast a long outage. The last field, often called minimum, sets how long resolvers cache a "does not exist" answer. This lookup flags values outside the ranges the IntoDNS.ai domain scan uses, so both report the same thing.

Negative caching: the timer that surprises people

When a resolver asks for a name that does not exist, it caches that answer for the lower of the SOA record's own TTL and its minimum field (RFC 2308). If someone looks up a record before you create it, for example a certificate validation record or a new subdomain, their resolver keeps saying "does not exist" for that long after you add it. With a minimum of a day, a fresh record can seem broken for hours. Keep the value modest, and create records before announcing them.

Common SOA problems

A zone edited by hand without raising the serial, so secondaries never pick up the change and different nameservers give different answers; dig +nssearch shows the serial each one serves. An expire value of a few days, after which secondaries stop answering if the primary is down over a long weekend. An RNAME written as an email address with an @ sign, which is not valid in this field: the first dot stands for the @. On managed DNS (Cloudflare, Route 53, Google Cloud DNS and others) the provider sets the SOA, and you usually cannot and need not change it.

Primary sources

• RFC 1035 section 3.3.13: SOA RDATA format
• RFC 1912 section 2.2: SOA records
• RFC 2308: negative caching of DNS queries
• RFC 1982: serial number arithmetic