[ Free tool · DNS & Mail Servers ]
SOA Record Checker
Grade your zone's serial, refresh, retry, expire and negative TTL.
[ About this tool ]
This SOA checker reads a zone's Start of Authority record and grades serial, refresh, retry, expire and negative-cache TTL against RFC 1912 recommendations.
How to read the results
- ›Retry should be lower than refresh.
- ›Expire should be one to four weeks.
- ›A long negative-cache TTL delays new SPF and DKIM records being seen.
Frequently asked questions
What is an SOA record?
The Start of Authority record names a zone's primary nameserver and admin contact and sets timers that control how secondary servers and resolvers cache it.
Learn more in our guide: What is Email Authentication? SPF, DKIM and DMARC Explained
Enterprise provenance
Why top financial institutions and governments retired their email security dashboards.
Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.
EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.
SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption
[ More tools ]
Full Domain Health Scan
Run every email security check at once and get one score.
A & AAAA Lookup
See IPv4 and IPv6 addresses for a domain and its www host.
DNS Propagation Checker
Look up any record across Cloudflare, Google and AliDNS side by side.
DMARC Checker
Look up and explain any domain's live DMARC record.
SPF Checker
Validate your SPF record and check the 10-lookup limit.
DKIM Lookup
Verify a DKIM selector is published and the key is valid.