Decode a zone's SOA record: primary server, contact, serial and cache timers
Runs in your browser. Only the lookup you start is sent to cloudflare-dns.com or dns.google; nothing else leaves your device. Updated on 25 Oct 2026.Every DNS zone starts with one SOA record: the primary name server, the mailbox of whoever runs the zone, a serial number that goes up with each change, and four timers. Type the domain and each part is labelled. The last number matters most in practice: it is how long resolvers remember that a name does not exist, which is why a newly added subdomain can stay invisible for a while.
Keep SOA selected in the Record type list, as the page opens with it.
Type the domain, such as example.com, and press Look up.
Read the labelled parts: Primary name server, Responsible mailbox, Serial, Refresh, Retry and Expire.
Read Negative-caching TTL to see how long resolvers remember that a name does not exist.
This DNS lookup asks a public resolver, Cloudflare 1.1.1.1 or Google 8.8.8.8, the same question dig or nslookup would, and shows the answer in a table. Pick one record type, or "All common types" to ask for A, AAAA, CNAME, MX, NS, TXT, SOA, CAA and HTTPS together. Every record shows its TTL in seconds and in words, because the TTL is how long any copy of it may be cached.
The records that are hard to read by eye are split into labelled fields. An SOA becomes its primary server, the contact mailbox, the serial and four timers. A CAA record becomes flags, tag and value. An SRV record becomes priority, weight, port and target, with the service named from the record's own name. DS and DNSKEY records show the algorithm by name, and the key tag of each DNSKEY is worked out so you can match it against the DS record at the parent.
A browser cannot send DNS packets itself, so the page uses DNS over HTTPS. The name you type goes to the resolver you chose, which is how it gets an answer; nothing else about you or your other searches is sent. You see what that resolver has in its cache, which can lag a recent change by up to the record's TTL. To compare two resolvers side by side, use the DNS Propagation Checker.
The rest of the article, and all 6 questions about DNS Lookup, are on the DNS Lookup page.
Yes. No signup and no limit on how many names you look up. Each lookup is one request from your browser to Cloudflare or Google, both of which run their public resolvers free of charge. The page is supported by a few ads shown outside the tool.
A resolver that already cached the old answer keeps it until its TTL runs out, then asks again. A name that did not exist is remembered as missing for the SOA record's last number of seconds. Wait that long, or compare both resolvers in the DNS Propagation Checker.
NXDOMAIN is the DNS answer for a name that does not exist at all, for any record type. Common causes are a typo, a subdomain that was never created, or a domain that has expired. A name that exists but lacks the type asked for gets a different answer: no records.
No. DNS answers questions about names you already know; there is no query that lists every name in a zone, and zone transfers are refused by almost every public server. Certificate transparency logs are the usual way to discover subdomains, and this tool does not search them.
Still stuck? Ask about DNS Lookup and anybody who knows can answer. No account needed.
Same job, other tools: AS Number Lookup – Turn an AS number into the network name, registry and allocation date · IP to ASN Lookup – Map an IP address to the ASN that announces it, with the BGP prefix.
On the related tools: Open Port Checker – See if a port forwarded on your router is reachable from the internet.