Zone delegation details should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · DNS · All checks

Run this check

Invoke-Maester -TestId AD-DNS-09

Overview

Detailed information about DNS delegations is essential for:

• Security auditing: Understanding what subdomains are delegated and to whom
• Dependency mapping: Knowing which external servers are trusted
• Incident response: Quickly identifying affected delegations during incidents
• Compliance documentation: Maintaining records of DNS infrastructure

Control Type

Operational

Security Recommendation

Review delegation details regularly and:

• Verify all target name servers are authorized
• Remove delegations for decommissioned services
• Document the purpose and owner of each delegation
• Implement monitoring for delegation changes

How the Test Works

This test provides detailed information about each zone delegation, including:

• Parent zone name
• Delegated subdomain
• Target name server

Related Tests

• Test-MtAdDnsZoneDelegationCount - Counts zone delegations

Details

Every attribute of this check

Field	Value
Test ID	AD-DNS-09
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	DNS
Area	Infrastructure hardening
Resource type	DnsZone
MITRE ATT&CK	None
PowerShell test	Test-MtAdDnsZoneDelegationDetails
Services	ActiveDirectory
Permissions	ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read

Source

• Test: tests/ad/dns/Test.AD-DNS-09.ps1
• Documentation: tests/ad/dns/Test.AD-DNS-09.md