📜

SOA Record Lookup

The Start of Authority (SOA) record stores essential administrative information about a DNS zone.

RFC: RFC 1035
FIELDS: MNAME, RNAME, SERIAL
TIMERS: REFRESH, RETRY, EXPIRE

What is SOA Record Lookup?

An SOA record is mandatory and forms the foundation of any DNS zone. It declares the primary name server, the email of the administrator, and the timing parameters that govern how secondary name servers sync changes.

How it Works

When secondary DNS servers query the master server, they check the SOA's SERIAL number. If the master's serial is higher, the secondary initiates a zone transfer. The REFRESH timer governs how frequently they check.

Key Use Cases

Understanding why a DNS propagation is delayed based on TTL and Refresh timers.

Verifying the primary authoritative nameserver for a zone.

Locating the technical contact (RNAME) for a resolving domain.

Advanced Details

The RNAME field contains the admin's email, but the "@" symbol is replaced with a dot. For example, hostmaster.example.com translates to hostmaster@example.com.

Cybersecurity Pros & Cons

Security Advantages
  • The RNAME field exposes a direct admin contact for responsible disclosure and abuse reporting.
  • SOA serial numbers help security teams detect unauthorized zone modifications during incident response.
  • Short Refresh/TTL timers allow rapid DNS changes during an active domain hijacking incident.
  • Monitoring SOA serial changes is a reliable indicator of unauthorized DNS zone tampering.
Security Limitations
  • The RNAME admin email exposed in the SOA is a prime target for spear-phishing and social engineering attacks.
  • Excessively short REFRESH timers increase zone transfer frequency, amplifying traffic during a DNS DDoS.
  • SOA records can be queried to fingerprint the DNS server software version, enabling targeted exploits.
  • Overly long EXPIRE timers mean secondary servers may serve stale, potentially compromised DNS data for days.
Ready to Test?

Use our professional-grade tool to perform a real-time check for this module.

Run Module Now
Related Docs