Skip to main content
Version: 2.2.1-preview

AD-DNS-06 - Zones with non-default records should be retrievable

Michael SouleMerill Fernando
Contributed by Michael Soule with Merill FernandoAll contributors →

Overview​

Zones with non-default records (beyond SOA and NS) are actively used for DNS resolution. Understanding which zones contain actual service records helps:

  • Identify active services: Zones with records indicate active DNS services
  • Assess attack surface: More active zones mean more potential targets
  • Plan maintenance: Active zones require more careful change management
  • Audit compliance: Verify only authorized zones are in use

Security Recommendation​

Regularly review zones with non-default records to ensure they are all necessary and properly secured. Verify that zone contents align with authorized services and applications.

How the Test Works​

This test identifies DNS zones that contain records beyond the default SOA and NS records, excluding special zones like RootDNSServers and reverse lookup zones.

  • Test-MtAdDnsZoneCount - Counts all zones with records
  • Test-MtAdDnsZonesWithOnlySoaNs - Finds zones with only default records

Test Metadata​

FieldValue
Test IDAD-DNS-06
SeverityInfo
SuiteActive Directory
CategoryAD.DNS
PowerShell testTest-MtAdDnsZonesWithRecordsCount
TagsAD, AD-DNS-06, AD.DNS

Source​

  • Pester test: tests/ad/dns/Test-MtAdDnsZonesWithRecordsCount.Tests.ps1
  • PowerShell source: powershell/public/ad/dns/Test-MtAdDnsZonesWithRecordsCount.ps1