The manual says under DNS Specific: "Check result: Check if the response contains certain strings. Define below. ... Enter elements that the response of the DNS server must contain. Enter each entry in one line. The received result must contain at least one of the elements."
Why is the sensor not picking EXPIRE value? (always part of an SOA content) If it's not possible, why do you describe it in the manual!!???