Free · live registry data · no login

SOA Record Checker

Serial, refresh and TTL values for the zone.

How it works

Read a zone's SOA record and check its timers

Every DNS zone starts with one SOA (Start of Authority) record: the primary nameserver, the admin email, a serial number that must change on every edit, and the refresh, retry, expire and negative-cache timers that control how secondary servers and resolvers behave. Enter a domain and we fetch the SOA live, decode each field into plain language, compare the timers with RIPE's recommended ranges and confirm the primary server is one of the delegated nameservers.

Results appear here after you click Check SOA.

How this works

1
Fetch the SOA
The zone's Start of Authority record is queried live; if the name is inside a parent zone we read the parent's SOA from the authority section.
2
Decode the fields
Primary server, admin mailbox, serial style and the four timers are translated into plain language.
3
Compare with best practice
Each timer is checked against RIPE-203 ranges and the primary is matched against the delegated NS set.

Frequently asked questions

What is an SOA record?: The Start of Authority record is the first record in every DNS zone. It names the primary nameserver and administrator, carries a serial number that changes with every edit, and sets the timers secondary servers use to stay in sync plus the negative-caching TTL resolvers use for names that do not exist.
What should the SOA serial number be?: Anything that increases on every change. The classic format is YYYYMMDDnn, for example 2026101601 for the first edit on 16 October 2026. Managed DNS providers often use a plain counter or a unix timestamp instead, which is equally valid.
Why does the negative-cache TTL matter to me?: When you add a new record and someone looked it up moments before, their resolver remembers 'does not exist' for the SOA minimum value. A large value such as 86400 makes new subdomains or verification records appear broken for a day. Keep it at 3600 or below.
What are good refresh, retry and expire values?: RIPE-203 recommends refresh of 86400 (24 h) for stable zones or 1200 to 7200 for busy ones, retry around 7200 or less, and expire of 3600000 (about 6 weeks) so secondaries survive a long primary outage. With NOTIFY in use, refresh matters less.
The primary server in my SOA is not one of my nameservers. Is that wrong?: Usually not. Cloud DNS providers run a hidden primary that pushes to the public anycast servers you see in NS, so the MNAME names a machine that is not meant to receive queries. It only matters for dynamic DNS updates, which are sent to the MNAME.

Every MailShrine domain includes WHOIS privacy, transfer lock, Anycast DNS with DNSSEC and two business mailboxes.