9

What parameters are required to retrieve the zone file version, when using the Linux dig command (of any of the "Root DNS" servers/zonefiles like versign etc...)?

1 Answer 1

15

You probably want the "serial number", which is part of the SOA record:

$ dig +multi stackoverflow.com soa
; [lots of output snipped]

;; ANSWER SECTION:
stackoverflow.com.      86400 IN SOA ns1.p19.dynect.net. jatwood.stackoverflow.com. (
                                  2009090940  ; serial
                                  3600        ; refresh (1 hour)
                                  600         ; retry (10 minutes)
                                  604800      ; expire (1 week)
                                  60          ; minimum (1 minute)
                                  )
$ dig +short google.com soa
ns1.google.com. dns-admin.google.com. 1415583 7200 1800 1209600 300

Serial number is the 3rd field: 2009090940 and 1415583 in these examples.

dig can also look up SOA records from all authoritative servers at once:

$ dig +nssearch google.com
SOA ns2.google.com. dns-admin.google.com. 147807924 900 900 1800 60 from server 216.239.34.10 in 49 ms.
SOA ns3.google.com. dns-admin.google.com. 147820290 900 900 1800 60 from server 216.239.36.10 in 53 ms.
SOA ns3.google.com. dns-admin.google.com. 147807924 900 900 1800 60 from server 216.239.38.10 in 54 ms.
SOA ns3.google.com. dns-admin.google.com. 147807924 900 900 1800 60 from server 216.239.32.10 in 62 ms.

However, don't be surprised if you receive utterly meaningless serial numbers.

The only purpose of 'serial', 'refresh', 'retry', & 'expire' parameters is to aid in zone synchronization in traditional AXFR-based setups, and they become entirely useless if the underlying database is synchronized using its own means (e.g. PostgreSQL replication).

For example, since originally writing this post, Stack Overflow has since moved to AWS DNS which always sets the serial number to 1.

0

You must log in to answer this question.