Guide
The SOA record: serial numbers, timers and negative caching
The first record in every DNS zone is the start of authority, SOA. It has seven fields and is mostly invisible until something goes wrong with zone transfers or with how long a nonexistent name stays cached. The page reads it for a domain and translates every number into readable units, with a sentence on what each one controls.
The seven fields
MNAME is the primary name server, the one that holds the master copy. RNAME is the responsible person’s mailbox, written with a dot in place of the @, so hostmaster.example.com means [email protected]; a dot inside the local part is escaped with a backslash. The serial is a counter that secondary servers compare. Refresh is how often they check the primary for a new serial. Retry is how soon they try again after a failed check. Expire is how long they keep answering from their copy if the primary stays unreachable. The last field was once the default TTL and has meant the negative-caching TTL since RFC 2308: how long resolvers remember that a name does not exist.
Why the serial matters
When a secondary server polls, it asks for the SOA and compares the serial with its own. A larger number means a newer zone, so it requests a transfer; an equal or smaller number means nothing to do. This is why changing a zone without increasing the serial leaves secondaries stale. The date convention YYYYMMDDnn gives room for 99 changes per day and makes the history readable. The page flags a serial that does not look like a date, which is not an error, only worth knowing.
The negative-caching time
When someone looks up a name that does not exist, the resolver stores that fact for the lesser of the SOA’s minimum field and the SOA record’s own TTL. That is useful for performance, but it hurts when you create a new host: anyone who looked it up a minute earlier will keep getting “does not exist” until the cache expires. A short value, such as 300 to 3600 seconds, limits that delay. The page shows the record TTL beside the minimum for this reason.
A worked example
Press Sample to look up example.com. The page prints the primary server (an elliott.ns.cloudflare.com name), the mailbox [email protected], the serial number with a note that it is not in the date format, and the timers with conversions: refresh 10000 s (2 h 46 min 40 s), retry 2400 s (40 min), expire 604800 s (7 d), and a minimum of 1800 s (30 min). The record’s own TTL is also 1800 s. Managed providers choose values like these because they run all the servers themselves and do not use classic zone transfers.
Limits
The values are what the resolver you selected has cached, so the serial may lag behind the primary by up to the record’s TTL. The page reads one record; it cannot tell whether secondary servers are in sync, which needs a query to each name server. Look up the registered domain, not a subdomain, unless the subdomain is delegated as its own zone. To write an SOA yourself, the BIND Zone File Generator fills in sensible defaults.
Related tools
- NS Lookup lists the servers that hold these records.
- DNS TTL Calculator explains TTL values and plans changes.
- BIND Zone File Generator builds a zone with a valid SOA.
- DNS Lookup shows the SOA among other records.
Checked against the current version of the SOA Lookup on .