Root servers with incorrect IPs should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · DNS · All checks

Run this check

Invoke-Maester -TestId AD-DNS-03

Overview

Root DNS server hints are essential for external DNS resolution. Incorrect root server IP addresses can:

• Prevent external DNS resolution: Clients cannot resolve internet domain names
• Indicate compromise: Unexpected changes may indicate DNS poisoning attacks
• Cause service outages: Applications dependent on external DNS will fail
• Impact security updates: Systems may be unable to reach update servers

The root server IP addresses are maintained by IANA and change very infrequently. Any deviation from the official addresses should be investigated immediately.

Control Type

Detective

Security Recommendation

• Verify root server hints against the official IANA list
• Investigate any discrepancies immediately
• Use secure update mechanisms for root hints
• Monitor for unauthorized changes to DNS configuration

How the Test Works

This test compares configured root server IP addresses against the official IANA root server list and reports any discrepancies.

Related Tests

• Test-MtAdDnsRootServerIncorrectDetails - Provides detailed information about incorrect root servers

Details

Every attribute of this check

Field	Value
Test ID	AD-DNS-03
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	DNS
Area	Infrastructure hardening
Resource type	DnsZone
MITRE ATT&CK	None
PowerShell test	Test-MtAdDnsRootServerIncorrectCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read

Source

• Test: tests/ad/dns/Test.AD-DNS-03.ps1
• Documentation: tests/ad/dns/Test.AD-DNS-03.md