SOA record check
Asks the public resolvers for the SOA of the zone apex and checks the serial against the YYYYMMDDnn form and refresh, retry, expire and the negative caching TTL against RFC 1912 and RFC 2308. The zone's own name servers are not contacted.
Updated 2026-10-27
What this tool checks
The SOA record is asked for through public resolvers, and its fields are judged with the same rules as the zone file checker:
- Serial: whether it has the recommended date form.
- Refresh and retry: refresh between 20 minutes and 12 hours, and retry shorter than refresh (
SOA_RETRY_NOT_BELOW_REFRESH). - Expire: at least two weeks, and longer than refresh plus retry.
- Negative caching: a minimum of at most three hours.
How to read the result
The result shows every SOA field. The findings are recommendations: a zone with NOTIFY and a large provider can work well with other values.
Limitations
- The zone's own name servers are not asked, so different serials on different servers are not detected.
Use it from code
API reference for SOA record check
curl -i "https://api.lookproof.dev/v1/dns/soa?domain=example.com"A request without payment is answered with 402 Payment Required and the exact price. See the API reference.
Limits
| Input | Domain |
|---|---|
| Deadline | 10 seconds |
| Freshness | Up to 5 minutes, never longer than the record TTL |
| Price | $0.01 per check |
Findings this tool can report
SOA record (7)
- Warning
SOA_EXPIRE_BELOW_REFRESHThe SOA expire is not longer than refresh plus retry. - Info
SOA_EXPIRE_SHORTThe SOA expire is shorter than two weeks. - Info
SOA_NEGATIVE_TTL_LONGThe SOA minimum (negative caching TTL) is longer than three hours. - Info
SOA_NOT_FOUNDThe name has no SOA record, so it is not the apex of a zone. - Info
SOA_REFRESH_OUT_OF_RANGEThe SOA refresh is outside 20 minutes to 12 hours. - Warning
SOA_RETRY_NOT_BELOW_REFRESHThe SOA retry is not shorter than the refresh. - Info
SOA_SERIAL_NOT_DATEThe SOA serial is not in the YYYYMMDDnn date form.
Check (1)
- Warning
CHECK_QUERY_BUDGET_EXCEEDEDThe check stopped after reaching its DNS query limit.
DNS (3)
- Error
DNS_DOMAIN_NOT_FOUNDThe DNS resolver reported that the domain does not exist. - Warning
DNS_RESOLVER_FAILUREThe DNS resolver returned a server failure. - Warning
DNS_RESOLVER_TIMEOUTThe DNS resolver did not answer in time.
Frequently asked questions
What do the SOA timers do?
Refresh says how often secondary servers ask the primary for a new serial, retry how long they wait after a failure, and expire how long they keep answering without contact. The minimum field is the negative caching TTL: how long resolvers remember that a name does not exist (RFC 2308).
Why is my serial not in date form?
RFC 1912 recommends YYYYMMDDnn, such as 2026102701, but any number that grows with each change works. Many DNS services use a counter or a timestamp, so SOA_SERIAL_NOT_DATE is information only.
Which name should I check?
The zone's apex, usually the registered domain such as example.com. A name below it has no SOA record of its own and gets SOA_NOT_FOUND.