DNS zone count should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · DNS · All checks

Run this check

Invoke-Maester -TestId AD-DNS-01

Overview

DNS zones are the primary organizational units for DNS data. Understanding how many zones contain resource records helps assess:

• Infrastructure complexity: More zones indicate a more complex DNS environment
• Administrative boundaries: Zones often represent different administrative domains
• Service distribution: Multiple zones may indicate delegated or distributed services
• Security posture: Unused or empty zones may represent configuration drift

Control Type

Operational

Security Recommendation

Regularly audit DNS zones to ensure they are all necessary and properly configured. Remove unused zones and verify that zone delegation follows your organization’s security policies.

How the Test Works

This test retrieves all DNS zones and counts those that contain resource records. It provides:

• Total number of DNS zones
• Count of zones with records
• Count of empty zones

Related Tests

• Test-MtAdDnsEmptyZoneCount - Identifies zones with no records
• Test-MtAdDnsZonesWithOnlySoaNs - Finds zones with only default records

Details

Every attribute of this check

Field	Value
Test ID	AD-DNS-01
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	DNS
Area	Infrastructure hardening
Resource type	DnsZone
MITRE ATT&CK	None
PowerShell test	Test-MtAdDnsZoneCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read

Source

• Test: tests/ad/dns/Test.AD-DNS-01.ps1
• Documentation: tests/ad/dns/Test.AD-DNS-01.md