Skip to main content
Version: 2.2.1-preview

AD-DNS-02 - Zones with only SOA/NS records should be retrievable

Michael SouleMerill Fernando
Contributed by Michael Soule with Merill FernandoAll contributors →

Overview​

DNS zones that contain only SOA (Start of Authority) and NS (Name Server) records are essentially placeholder zones. These zones:

  • May indicate incomplete configuration: Zones created but never populated with actual records
  • Could represent abandoned infrastructure: Services that were planned but never deployed
  • Might be unnecessary: Adding complexity without providing value
  • Can cause confusion: Administrators may assume these zones are actively used

Security Recommendation​

Review zones with only SOA/NS records and either:

  • Populate them with necessary resource records if they serve a purpose
  • Delete them if they are no longer needed
  • Document their purpose if they are intentionally placeholder zones

How the Test Works​

This test identifies DNS zones that contain only SOA and NS records, with no A, AAAA, CNAME, MX, SRV, or other record types.

  • Test-MtAdDnsZoneCount - Counts all zones with records
  • Test-MtAdDnsEmptyZoneCount - Finds zones with zero records

Test Metadata​

FieldValue
Test IDAD-DNS-02
SeverityInfo
SuiteActive Directory
CategoryAD.DNS
PowerShell testTest-MtAdDnsZonesWithOnlySoaNs
TagsAD, AD-DNS-02, AD.DNS

Source​

  • Pester test: tests/ad/dns/Test-MtAdDnsZonesWithOnlySoaNs.Tests.ps1
  • PowerShell source: powershell/public/ad/dns/Test-MtAdDnsZonesWithOnlySoaNs.ps1