How to check SOA serial numbers with dig

Authoritative nameservers can serve different copies of a DNS zone while a change is loading or transferring. The SOA serial is the version number in each zone copy, and matching values show that the responding authority set has converged on the same revision.

The dig +nssearch option discovers the authoritative nameservers for a zone and asks each one for its SOA record. It also reports server addresses that do not respond, so one command exposes both serial disagreement and an incomplete authority check.

Use the delegated zone apex rather than a host inside the zone. Each result places the serial immediately after the responsible mailbox; the remaining numbers are the refresh, retry, expire, and minimum values, followed by the responding server address and query time.

Related: How to find authoritative nameservers with dig
Related: How to query a specific DNS server with dig
Tool: Nameserver Health Check

Steps to check SOA serial numbers with dig:

  1. Run an authority-wide SOA search with the delegated zone apex in place of iana.org. 
    $ dig iana.org +nssearch
SOA sns.dns.icann.org. noc.dns.icann.org. 2026070816 7200 3600 1209600 3600 from server 199.43.134.53 in 105 ms.
SOA sns.dns.icann.org. noc.dns.icann.org. 2026070816 7200 3600 1209600 3600 from server 199.4.138.53 in 264 ms.
SOA sns.dns.icann.org. noc.dns.icann.org. 2026070816 7200 3600 1209600 3600 from server 199.43.135.53 in 267 ms.
SOA sns.dns.icann.org. noc.dns.icann.org. 2026070816 7200 3600 1209600 3600 from server 199.43.133.53 in 274 ms.

    +nssearch discovers the authority set and prints the SOA record returned by each responding server.

  2. Identify the serial as the first number after the responsible mailbox on each server row.

    For iana.org, the mailbox is noc.dns.icann.org. and the observed serial is 2026070816.

  3. Confirm the first number after the mailbox matches across every responding server row.

    A different value proves that the checked authority set is serving more than one zone revision. Serial numbers wrap at 32 bits, so a simple larger-number comparison does not always identify the newer revision.

  4. Confirm +nssearch did not report any authoritative server address as nonresponsive.

    A serial mismatch or nonresponsive authority leaves the check unresolved; inspect that server's zone load, transfer, or provider synchronization state before treating the DNS change as complete.