ToolsDNS & domains

SOA checker

Read a zone's SOA record and compare its timers with recommended values. Anything that differs is highlighted, with what it means.

Queries built and checked in your browser
Sent via abbott.cloud to Cloudflare, Google and Quad9

Check a zone

How this works

Your browser builds a query for the name's SOA record, asking for DNSSEC signatures too, and sends it via abbott.cloud/api/dns to Cloudflare, Google and Quad9 (DNS over HTTPS, RFC 8484).
If the name isn't the top of a zone, the answer names the zone it's in, and this page asks for that zone's SOA instead.
It reads the SOA's timers (RFC 1035 §3.3.13) and compares each with the recommended values above. It also checks that retry is shorter than refresh and that expire is long enough (RFC 1912 §2.2), and whether the three resolvers have the same serial number.
The SOA record's own TTL: a resolver gives the time left in its cache, which counts down. If the zone is signed with DNSSEC, the signature records the exact TTL (RFC 4034 §3.1.4). If not, this page uses the highest figure the three resolvers give, and doesn't call a lower figure a discrepancy, because it may just have counted down.

What's kept: nothing. The name you check goes in the page's address so you can share the result, but it isn't stored.

Good to know: refresh, retry and expire matter when secondary nameservers copy the zone from a primary by zone transfer. Many managed DNS hosts (such as Cloudflare, Amazon Route 53 and Azure DNS) run their own replication and set some of these values themselves; not all of them let you change every field. The minimum and the SOA's TTL affect everyone, because they control how long "doesn't exist" answers are cached (RFC 2308).

Code: soa.js (this page), lib/soa.js (checks), dnswire.js (packets), net.js (requests).

SOA checker

Check a zone

Recommended values