What is an SOA record?
The SOA (start of authority) record opens every DNS zone. It names the primary nameserver and a contact address, and carries a serial that rises with each change, three timers for secondary servers (refresh, retry, expire) and the minimum field, which RFC 2308 makes the TTL of negative answers: how long "does not exist" is cached.
Reading the result
Each field is shown with its value in seconds and in plain time. The negative-cache section matters most for anyone adding a record: a resolver that looked for the record before it existed keeps answering "not found" for the lower of the minimum field and the SOA’s own TTL. The tool also asks both resolvers for a made-up name and shows the TTL each gave the "does not exist" answer.
Beat runs on the same engine, on a schedule, across all 41 checks and 25 blacklists. What it adds is asking again, noticing when an answer changes and telling you what to do about it.
What it explains, and what it flags
A new record that still does not resolve
Usually negative caching rather than a mistake: a resolver asked before you published and cached the absence. Wait out the negative TTL shown here before changing anything.
A negative TTL over a day
RFC 2308 section 5 reports values over one day as problematic and suggests one to three hours. A long one makes every newly added record slow to appear.
Expire shorter than retry
RFC 1912 says expire must exceed retry, or a secondary server can drop the zone before it has tried again to refresh it.
A subdomain with no SOA of its own
Most subdomains are names inside their parent’s zone, not zones themselves. The tool then shows the parent zone’s SOA, which governs them.