SOA record lookup

What the SOA record lookup shows

An SOA record lookup shows the zone's start of authority: the primary nameserver, the responsible address, the serial number and the refresh, retry, expire and minimum timers. The query goes to Cloudflare's 1.1.1.1 from the IPVIEW server over the toolkit's own DNS engine. Every zone has exactly one SOA record, and the copy shown is the resolver's, which may lag the primary by up to its TTL.

The serial is the field that does the work. Secondary nameservers compare it with their own copy and transfer the zone only when it has gone up, so an edit that did not raise the serial never leaves the primary. The responsible address is written with the first dot standing for @: hostmaster.example.com means hostmaster@example.com.

How to read the result

The value shows primary, responsible address and serial, then refresh, retry, expire and minimum in seconds. Refresh is how often a secondary asks the primary for a new serial; retry is how soon it asks again after a failure; expire is how long a secondary keeps serving when the primary cannot be reached, after which it stops answering. Minimum is, under RFC 2308, how long resolvers cache a negative answer, the number that explains why a record you just created still reads as none elsewhere. The TTL here is the time left on 1.1.1.1's cached copy and can be lower than the TTL set in the zone; the Full report asks the zone's own nameservers for that.

A serial in the form YYYYMMDDnn is a convention, not a rule, but it makes a stale zone easy to spot. This tool asks one resolver; the Full report asks the first six nameservers directly and compares the serials. An empty answer is read from the response code: a subdomain that is not a zone has no SOA, NXDOMAIN means the name does not exist, and a failed query says nothing about the zone.

When it is useful

You edited a zone and nothing changed anywhere. If the serial here is the one from before your edit, the zone was not reloaded or the serial was not raised, and no waiting will help. If it did go up, the remaining delay is the old record's TTL, and DNS propagation shows which resolvers have caught up.

When a zone resolves on some nameservers and not others, a primary unreachable for longer than the expire timer is a classic cause: the secondaries have stopped answering. The Delegation check lists the nameservers, and the Full report compares their serials and names those that did not answer.

Common questions

What is an SOA record?

The record at the top of every zone naming its primary nameserver and responsible contact and carrying the serial and timers secondaries use to keep their copy in step. A zone has exactly one.

Why does my DNS change not propagate?

Most often because the serial did not increase, so secondaries see nothing new to transfer. Compare the serial here with your zone file. If it did increase, the old records are simply cached up to their TTL.

What do refresh, retry and expire mean?

Refresh is how often a secondary checks for a new serial, retry how soon it tries again after a failure, and expire how long it keeps answering without reaching the primary at all. All three are in seconds.