Bulk SOA record lookup: serial, timers and primary server for a list of domains
In short: Paste domains and get each zone's SOA record: primary name server, hostmaster address, serial (and whether it reads as a date), refresh, retry, expire and the negative-caching TTL, with timers outside the RFC 1912 and RFC 2308 suggestions flagged. Limit: Answers come from a public resolver, not each zone's authoritative servers, so a fresh change may not show yet.
A bulk SOA record lookup asks DNS for each domain's Start of Authority record. Paste one domain or up to 100 (500 after a Google sign-in): each shows its primary name server, contact address, serial and the refresh, retry, expire and negative-caching timers, marked Within RFC ranges, Outside RFC ranges, Timer conflict, No zone found or Lookup failed.
Price: this tool is free. Checking a whole email list is from $9/mo, and the first 100 checks are free with Google, no card. See pricing
Sample result
globex.example's SOA sets a 1-day negative TTL, so a new DKIM record can look missing for a day.
- Zone
- globex.example
- Serial
- 2026110402
- Negative TTL
- 1 day
What this means for you
Read the serial, primary server and timers of every zone, with values outside the RFCs flagged.
- Primary server and contact
- Serial read as a date or counter
- Refresh, retry, expire, negative TTL
- 100 domains a run, 500 when signed in
- SOA
- Serial
- Negative TTL
By SimpleVerifier Team · Last updated
Auditing DNS across many domains?
- Over 500 domains? Run them in batches of 500 when signed in and download the CSV after each.
- Look up the other record types with the bulk DNS lookup.
- Sending from these domains? Check the address list at /verify. The first 100 email checks are free with a Google sign-in, no card.
How do I look up the SOA record for many domains?
- Paste one domain or a list, one per line: up to 100 a run, or 500 after a free Google sign-in. Subdomains are fine; the zone they sit in is found.
- Press Look up SOA. Each name gets one SOA query, or up to four when it sits inside a parent zone.
- Read the primary server, contact, serial and timers, and the notes on anything outside the RFC suggestions.
- Download the CSV with every field in seconds.
Example
- You enter
- Three names:
acme.example,globex.exampleandmail.initech.example. - You get
acme.exampleWithin RFC ranges: primary ns1.acme.example, serial 2026110501 (a date), expire 2 weeks, negative TTL 1 h.globex.exampleOutside RFC ranges: negative TTL 1 day, so a new DKIM record can look missing for a day.mail.initech.examplesits in the initech.example zone: Timer conflict, retry 2 h is longer than refresh 1 h. Download the CSV.- Limits
- Up to 100 domains a run without an account and 500 when signed in with Google. DNS only, from a public resolver.
What is in an SOA record?
Every DNS zone has exactly one SOA (Start of Authority) record at its apex, defined in RFC 1035 section 3.3.13. MNAME is the primary name server. RNAME is the administrator's mailbox written as a name, with the first dot standing for @, so hostmaster.acme.com means [email protected]. SERIAL is the zone's version number. REFRESH, RETRY and EXPIRE tell secondary servers how often to check the primary for a new serial, how soon to retry after a failure, and how long to keep answering if the primary stays unreachable.
The last field, MINIMUM, was redefined by RFC 2308 section 4 as the negative-caching TTL: how long a resolver remembers that a name or record doesn't exist.
Which SOA values are recommended?
RFC 1912 section 2.2 suggests an expire of 2 to 4 weeks, and says it must be greater than the refresh and retry intervals, or a secondary could drop the zone before it gets a new copy. Retry is typically a fraction of refresh. It recommends serials in YYYYMMDDnn form, for example 2026110501 for the first change on 5 November 2026. RFC 2308 section 5 finds 1 to 3 hours works well for the negative-caching TTL.
The negative TTL matters most for email setup. If a resolver looked up selector._domainkey.acme.com before you published the DKIM key, it may keep answering "no such record" until that TTL runs out, so a new record looks missing. Many managed DNS hosts push changes to all their servers directly and use fixed SOA timers of their own; flagged values there are worth knowing, not necessarily worth changing.
Who uses this tool, and for what?
- DNS administrators
- Spot zones with a short expire or a retry longer than refresh across every domain.
- Email deliverability teams
- Find a long negative TTL before publishing new DKIM or SPF records.
- Migrations
- Confirm the serial moved and the primary name server changed after a DNS move.
- Agencies
- See which DNS host runs each client zone from the primary name server.
What can’t this tool tell you?
- Answers come from a public resolver, not each zone's authoritative servers, so a fresh change may not show yet.
- Secondary servers aren't compared; a secondary stuck on an old serial isn't detected.
- The ranges are RFC suggestions, not rules; managed DNS hosts often use fixed values on purpose.
- Up to 100 domains a run without an account and 500 signed in.
Common questions
- Why does a subdomain show a different zone?
- Most subdomains, like www or mail, are records inside the parent zone and have no SOA of their own. The lookup walks up one label at a time and shows the zone it found.
- What does Timer conflict mean?
- Expire isn't greater than refresh or retry, or retry isn't shorter than refresh. Secondaries could stop serving the zone between checks, so it's worth fixing at the primary.
- Does the serial have to be a date?
- No. Any number that increases with each change works (RFC 1982 defines how serials compare and wrap). Date-style serials are a convention that makes the last change easy to read.
- Is the SOA queried from the domain's own servers?
- No. It comes from a public resolver, so it can lag a change by up to the SOA record's own TTL.
- Can I look up many domains at once?
- Yes. 100 domains a run without an account and 500 after a free Google sign-in, with a CSV.
- Is the bulk SOA lookup free?
- Yes, it's a free tool with no card. DNS queries only.
Sources
You audited one domain. Cold outreach means thousands.
This tool checks a domain you type in. It will not tell you which addresses at that domain are real.
- Bulk mailbox verification with real SMTP checks
- The email finder — name plus company to a verified address
- Website enrichment for emails, owner names and socials
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.