Dynamic DNS record count should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · DNS · All checks

Run this check

Invoke-Maester -TestId AD-DNS-05

Overview

Dynamic DNS allows clients to register and update their own DNS records. While convenient, excessive dynamic registration can indicate:

• Security risks: Unauthorized devices may register in DNS
• Configuration issues: Misconfigured clients may create excessive records
• Stale data: Dynamic records may not be cleaned up properly
• Resource exhaustion: Too many dynamic records can impact DNS performance

Understanding the ratio of dynamic to static records helps assess the security and hygiene of your DNS environment.

Control Type

Operational

Security Recommendation

• Enable secure dynamic updates only (require authentication)
• Implement aging and scavenging to remove stale records
• Monitor for unusual patterns in dynamic registration
• Restrict dynamic updates to authorized systems only

How the Test Works

This test counts DNS records that have timestamps (dynamic) versus those without (static) and reports the ratio.

Related Tests

• Test-MtAdDnsZoneRecordDetails - Provides detailed record counts per zone

Details

Every attribute of this check

Field	Value
Test ID	AD-DNS-05
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	DNS
Area	Infrastructure hardening
Resource type	DnsZone
MITRE ATT&CK	None
PowerShell test	Test-MtAdDnsDynamicRecordCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read

Source

• Test: tests/ad/dns/Test.AD-DNS-05.ps1
• Documentation: tests/ad/dns/Test.AD-DNS-05.md