Zones with non-default records should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · DNS · All checks

Run this check

Invoke-Maester -TestId AD-DNS-06

Overview

Zones with non-default records (beyond SOA and NS) are actively used for DNS resolution. Understanding which zones contain actual service records helps:

• Identify active services: Zones with records indicate active DNS services
• Assess attack surface: More active zones mean more potential targets
• Plan maintenance: Active zones require more careful change management
• Audit compliance: Verify only authorized zones are in use

Control Type

Operational

Security Recommendation

Regularly review zones with non-default records to ensure they are all necessary and properly secured. Verify that zone contents align with authorized services and applications.

How the Test Works

This test identifies DNS zones that contain records beyond the default SOA and NS records, excluding special zones like RootDNSServers and reverse lookup zones.

Related Tests

• Test-MtAdDnsZoneCount - Counts all zones with records
• Test-MtAdDnsZonesWithOnlySoaNs - Finds zones with only default records

Details

Every attribute of this check

Field	Value
Test ID	AD-DNS-06
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	DNS
Area	Infrastructure hardening
Resource type	DnsZone
MITRE ATT&CK	None
PowerShell test	Test-MtAdDnsZonesWithRecordsCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read

Source

• Test: tests/ad/dns/Test.AD-DNS-06.ps1
• Documentation: tests/ad/dns/Test.AD-DNS-06.md