Skip to main content

SOA Record Lookup (Start of Authority)

Analyze your DNS zone metadata and synchronization settings

DNS synchronization issues? Check the SOA record to understand your zone settings and diagnose replication problems.

In iterative trace mode, the resolver is ignored.
Query multiple public resolvers to compare answers.

Zone metadata

View the primary server, administrative contact, and serial number that identifies your zone version.

Multi-resolver

Compare responses from Google, Cloudflare, and Quad9 to detect serial propagation issues.

Sync parameters

Analyze refresh, retry, and expire values that control synchronization between primary and secondary servers.

TTL and negative cache

Check the minimum TTL that defines how long negative responses (NXDOMAIN) are cached.

Free and unlimited

Test as many domains as needed. No signup required.

How to use the DNS lookup engine options effectively

What is the iterative trace?

The trace performs resolution step by step. The resolver first queries the root servers, then the TLD (.com, .fr, .eu), and then the authoritative servers of the target zone. At each step, the page shows the queried server, the answer, the RCODE, and the latency.

  1. 1. Root

    Discovery of the TLD servers for the requested name.

  2. 2. TLD

    Reference to the zone's NS (delegation).

  3. 3. Authoritative

    Final answer (or error) with TTL and latency.

What is it for?

  • Compare answers across resolvers and regions
  • Detect a hot cache, an overly long TTL, or an incomplete delegation
  • Explain a latency difference or an unexpected RCODE

Tip: keep the trace disabled for quick checks; enable it when investigating or preparing a ticket/post‑mortem.

What is the classic trace?

The classic trace queries only the selected resolver (UDP or DoH) and displays the answer as it is perceived from that network vantage point. You get the RCODE, the response sections, and the latency for the client → resolver leg.

  1. 1. Chosen resolver

    Uses the preset or custom configuration to run the query exactly like your service would.

  2. 2. Protocol preserved

    Respects the selected transport (UDP, TCP, or DoH) so you reproduce the real behaviour.

  3. 3. Detailed answer

    Shows the question, answer, and authority/additional sections when present, together with TTL and useful metadata.

Why use it?

  • Check the view of a specific resolver before suspecting delegation issues
  • Confirm cached values and the impact of a TTL or a flush
  • Document a resolution exactly as a client or microservice sees it

Tip: keep the iterative trace option turned off when auditing a given resolver; enable it afterwards to compare with the root → TLD → authoritative path.

How does the propagation test work?

The test queries a set of public resolvers (Google, Cloudflare, Quad9, OpenDNS, ISPs…) in parallel and groups the answers by content and RCODE. You instantly see who already picked up the update.

  1. 1. Multi-point resolvers

    Enables the propagation presets to question several actors spread around the world.

  2. 2. Automatic comparison

    Groups identical answers and highlights divergences or resolver-specific errors.

  3. 3. Actionable summary

    Provides a clear recap, the resolver list, their latencies, and each group's status.

When to use it?

  • Track how a DNS change propagates worldwide
  • Spot stale caches and decide on a targeted flush
  • Share a propagation snapshot in a ticket or post-mortem

Tip: while the propagation test is active, the resolver selector is frozen. Disable the mode to return to single-resolver diagnostics.

What is an SOA record?

An SOA (Start of Authority) record defines a DNS zone's authority. It contains essential zone information: primary server, administrative contact, serial number, and synchronization parameters.

SOA record structure:

FieldDescriptionExample
MNAMEPrimary DNS serverns1.provider.com.
RNAMEAdministrative contact (email)hostmaster.captaindns.com.
SerialZone version number2025012801
RefreshCheck interval (sec)7200
RetryDelay after failure (sec)900
ExpireZone abandonment (sec)1209600
MinimumNegative cache (sec)3600

SOA record example

captaindns.com.  3600  IN  SOA  ns1.provider.com. hostmaster.captaindns.com. (
    2025012801  ; Serial
    7200        ; Refresh (2 hours)
    900         ; Retry (15 minutes)
    1209600     ; Expire (14 days)
    3600        ; Minimum TTL (1 hour)
)

RNAME contact explanation

The contact is written as a DNS name: hostmaster.captaindns.com. corresponds to email hostmaster@captaindns.com. The first dot replaces the @ symbol.


ParameterRecommended valueExplanation
Refresh3600-7200Check every 1-2 hours
Retry600-900Retry after 10-15 minutes
Expire604800-1209600Abandon after 1-2 weeks
Minimum300-3600Negative cache 5 min to 1 hour

Serial format

The YYYYMMDDNN format is recommended:

  • 2025012801 = January 28, 2025, modification #1
  • 2025012802 = January 28, 2025, modification #2

Important rules

SOA uniqueness

RuleExplanation
One SOA onlyAlways at the zone apex
With NS recordsSOA and NS coexist at apex
No CNAMEApex cannot be a CNAME

Best practices

PracticeWhy
Increment serialRequired for each modification
Valid contactTo receive notifications
Sufficient expirePrevents zone loss at secondaries

Common issues

Serial not incremented

Secondaries don't update because serial hasn't changed.

  1. Increment serial in zone
  2. Reload zone on primary
  3. Verify propagation

Synchronization failed

A secondary server shows an old serial.

  1. Check network access between primary and secondary
  2. Verify zone transfer permissions
  3. Wait for a refresh cycle

Zone abandoned by secondary

Secondary exceeded expiration timeout.

  1. Verify primary is accessible
  2. Increase expire value if needed
  3. Force a zone transfer

Command line verification

Linux/Mac

dig SOA captaindns.com

Compare serials across different servers:

dig SOA captaindns.com @ns1.provider.com +short
dig SOA captaindns.com @ns2.provider.com +short

Windows

nslookup -type=soa captaindns.com

ToolPurpose
NS Record LookupCheck authoritative servers
A Record LookupCheck primary server IP
DNS Propagation CheckCheck worldwide propagation

Useful resources