Soa Lookup Online — Free Soa Lookup Tool
CodexFuse Team · 2026-11-05T21:25:02.838Z · 9 min read min read
Run a free SOA lookup to check your domain's Start of Authority record — serial, nameserver and timers — and catch DNS problems before they break email.
An SOA lookup reads the Start of Authority record for a domain — the single DNS record that names the primary nameserver, the administrator's contact, and the timers controlling how the rest of the internet caches and copies that domain's DNS. If your website or email has ever behaved strangely after a DNS change, the SOA record is usually where the explanation lives.
Most people never look at it. That is a mistake: the SOA record governs how quickly changes spread and whether secondary nameservers receive updates at all. A thirty-second check can save hours of guessing.
What Is an SOA Record — and Why Does It Matter?
An SOA record is the first record in every DNS zone file, and it acts as the zone's identity card: it names the primary nameserver for the domain, gives the administrator's email address, and sets the serial number plus five timing values that tell other servers how to handle the zone. Every domain has exactly one SOA record, and every DNS change — a new mail server, a moved website, a corrected TXT record — is governed by the rules it sets.
What the Record Shows You
Run the check on any domain and you get seven fields. Each one does a specific job, and each one can be the source of a real problem.
| Field | What it means | What goes wrong when it is off |
|---|---|---|
| MNAME | The primary nameserver for the zone | Queries and updates go to the wrong server |
| RNAME | The zone administrator's email (dots replace @) | Abuse or error reports never reach anyone |
| Serial | The zone version number, usually a date plus a counter | Secondary servers never pick up changes |
| Refresh | How often secondaries check for updates | Changes take hours instead of minutes to spread |
| Retry | How long a secondary waits after a failed check | A brief outage delays updates for hours |
| Expire | How long secondaries keep serving stale data if the primary vanishes | Your domain disappears during a long outage |
| Minimum TTL | How long resolvers cache negative answers | A typo'd record stays "not found" for hours |
The serial number deserves special attention. Secondary nameservers compare it with the copy they hold; if the primary's serial is not higher, they assume nothing changed. Forget to raise the serial after editing a zone and your change simply never propagates — no error, no warning, just silence.
Read the serial as a date. A serial of 2026110502 means the zone was last edited on 5 November 2026, second change of the day. If the serial is months old but you know records changed recently, your edits are not reaching the primary server.
How to Run an SOA Lookup on CodexFuse
The free SOA lookup tool needs one input: a hostname. Type the domain, run the check, and the full SOA record appears in seconds — no account, no install, no waiting.
- Enter the domain. Type the hostname exactly as it appears in your DNS, without http:// or a trailing path.
- Run the lookup. The tool queries the domain's authoritative nameservers and returns the live SOA record.
- Read the seven fields. Check the serial date, the primary nameserver, and the refresh and retry timers against what you expect.
- Compare before and after. Run the check again after any DNS edit to confirm the serial moved and the new values are live.
That last step is the one people skip. A check before a change gives you a baseline; a check after the change proves the change actually happened.
A Worked Example: The Law Firm Whose Email Kept Going Missing
Consider a fictional scenario that plays out in real offices every week. Harper & Cole, a 14-person law firm in Manchester, moved its email to a new provider on a Friday afternoon. By Monday, three clients reported that their messages had bounced, while other clients' emails arrived normally. The MX records looked correct, and the new provider insisted its side was fine.
An SOA lookup on harpercole-legal.co.uk told the story in seconds. The primary nameserver was still ns1.oldhosting.example — the previous host, not the new one. The serial was 2026103001, last edited 30 October, six days before the migration. Refresh was 86400 seconds (24 hours), retry 7200 seconds (2 hours), expire 3600000 seconds (around 41 days), and minimum TTL 86400 seconds.
The diagnosis was obvious. The firm had updated its MX records at the new provider, but the SOA still pointed at the old host and the serial had never been raised. Half the internet was still asking the old server, which served the old MX records — so roughly half of incoming mail went to a dead mailbox, and the 24-hour refresh timer meant even a correct fix would take up to a day to spread.
The fix took twenty minutes: point the SOA at the new primary nameserver, raise the serial to 2026110601, cut refresh to 3600 and minimum TTL to 300 during the migration window, then run the check again to confirm the new values were live. Within an hour, the bounces stopped. The firm lost one morning of email; without the lookup, it could have lost a week to finger-pointing between two providers.
A stale serial is silent. DNS gives you no error when a secondary skips an update — it simply keeps serving the old zone. If a DNS change "hasn't taken effect yet" after several hours, check the SOA serial first. It is the most common cause, and the cheapest to fix.
Which SOA Problems Should You Watch For?
Most SOA trouble falls into a handful of patterns:
- Serial never increments. Edits made but the version number unchanged, so secondaries ignore them entirely.
- Wrong primary nameserver. The MNAME points at a decommissioned host, so updates go nowhere.
- Refresh set far too high. Values like 86400 mean a full day between update checks — fine for a static site, painful during a migration.
- Expire set far too low. A short expire means a primary-server outage can take your whole domain offline within hours.
- Minimum TTL too high. A typo'd record or a wrong MX entry stays cached as "does not exist" for a day or more.
- Dead admin contact. The RNAME points at a former employee's inbox, so DNS error reports vanish.
None of these show up in a standard DNS lookup of A or MX records alone. The records themselves can look perfect while the SOA timers quietly sabotage them.
CodexFuse manages your hosting, DNS, email and security in one place, on pay-as-you-go credits — so migrations, record changes and renewals are handled for you instead of eating your afternoon.
Get Started with CodexFusePairing the SOA Check With Other DNS Checks
The SOA record answers one question: is the zone itself healthy and current? Pair it with the right checks for the full picture.
- DNS propagation check. After confirming the serial moved, use a DNS propagation checker to see whether resolvers worldwide have picked up the new records yet.
- SPF record check. If email is landing in spam, verify your sender policy with an SPF record checker — a correct SOA will not save a broken SPF record.
- DKIM record check. For signed mail, a DKIM record checker confirms the signing key actually published.
- Email deliverability review. When several of these look right but mail still fails, the problem is often process rather than records — how one nonprofit fixed email deliverability in 30 days shows the step-by-step approach.
What This Check Cannot Tell You
Honest limits matter here. The SOA record shows the zone's control values; it does not test whether your website loads, whether mail flows, or whether a record is correct. It will not reveal a wrong A record, a typo'd MX entry, or a firewall blocking port 25. Treat it as a first diagnostic, not a final verdict.
When Should You Stop Managing DNS Yourself?
For a single domain that rarely changes, a free tool and a careful hand are enough. The pain starts when you run several domains or juggle hosting, email and security across dashboards — that is when a missed serial costs real money.
CodexFuse takes that burden off your plate. DNS, hosting, business email and backups live in one managed platform, paid for with credits as you use them — no subscriptions, no lock-in. Migrations are handled as a concrete workflow: your domains are moved, records are checked with tools like the SOA lookup, and the timers are set sensibly for the move, then tightened back once everything is stable.
Frequently Asked Questions
What does SOA stand for in DNS?
SOA stands for Start of Authority. It identifies the primary nameserver for a domain's DNS zone, names the zone administrator, and sets the serial number and timing values controlling how the zone is copied and cached.
Is the CodexFuse SOA lookup free?
Yes. The tool is free and unlimited — enter any hostname and see its SOA record instantly, with no account or sign-up required.
How often should I check my SOA record?
Before and after every DNS change, and whenever a change seems slow to take effect. A check every few months also catches stale admin contacts and forgotten timers before they cause trouble.
Why hasn't my DNS change taken effect yet?
The most common causes are a serial number that was never raised, a refresh timer measured in days rather than minutes, or resolvers caching the old record until its TTL expires. An SOA lookup shows you all three values in seconds.
Can a wrong SOA record break email?
Yes. If the SOA points at the wrong primary nameserver or the serial never increments, mail servers can keep reading outdated MX records — so some messages arrive and others bounce, exactly as in the law-firm example above.
What is a good refresh value for an SOA record?
For most small businesses, a refresh of 3600 seconds (one hour) and a retry of 600 to 3600 seconds work well. During a migration, drop refresh to 300–900 seconds so changes spread quickly, then raise it back once the move is stable.
Check Your SOA Record Before Your Next DNS Change
Thirty seconds with an SOA lookup can prevent a week of intermittent email failures and provider blame games. Run it on your main domain today and fix anything stale before it becomes an incident.
And if DNS has become one chore too many, move it to CodexFuse. Bring your domains, hosting and business email onto one fully managed platform, pay only for the credits you use, and let the platform handle the records and the monitoring. Start at codexfuse.dev today and hand the DNS babysitting over for good.
