Zones with only SOA/NS records should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · DNS · All checks

Run this check

Invoke-Maester -TestId AD-DNS-02

Overview

DNS zones that contain only SOA (Start of Authority) and NS (Name Server) records are essentially placeholder zones. These zones:

• May indicate incomplete configuration: Zones created but never populated with actual records
• Could represent abandoned infrastructure: Services that were planned but never deployed
• Might be unnecessary: Adding complexity without providing value
• Can cause confusion: Administrators may assume these zones are actively used

Control Type

Operational

Security Recommendation

Review zones with only SOA/NS records and either:

• Populate them with necessary resource records if they serve a purpose
• Delete them if they are no longer needed
• Document their purpose if they are intentionally placeholder zones

How the Test Works

This test identifies DNS zones that contain only SOA and NS records, with no A, AAAA, CNAME, MX, SRV, or other record types.

Related Tests

• Test-MtAdDnsZoneCount - Counts all zones with records
• Test-MtAdDnsEmptyZoneCount - Finds zones with zero records

Details

Every attribute of this check

Field	Value
Test ID	AD-DNS-02
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	DNS
Area	Infrastructure hardening
Resource type	DnsZone
MITRE ATT&CK	None
PowerShell test	Test-MtAdDnsZonesWithOnlySoaNs
Services	ActiveDirectory
Permissions	ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read

Source

• Test: tests/ad/dns/Test.AD-DNS-02.ps1
• Documentation: tests/ad/dns/Test.AD-DNS-02.md