Skip to main content
Version: 2.2.1-preview

AD-DNS-09 - Zone delegation details should be retrievable

Michael SouleMerill Fernando
Contributed by Michael Soule with Merill FernandoAll contributors →

Overview​

Detailed information about DNS delegations is essential for:

  • Security auditing: Understanding what subdomains are delegated and to whom
  • Dependency mapping: Knowing which external servers are trusted
  • Incident response: Quickly identifying affected delegations during incidents
  • Compliance documentation: Maintaining records of DNS infrastructure

Security Recommendation​

Review delegation details regularly and:

  • Verify all target name servers are authorized
  • Remove delegations for decommissioned services
  • Document the purpose and owner of each delegation
  • Implement monitoring for delegation changes

How the Test Works​

This test provides detailed information about each zone delegation, including:

  • Parent zone name
  • Delegated subdomain
  • Target name server
  • Test-MtAdDnsZoneDelegationCount - Counts zone delegations

Test Metadata​

FieldValue
Test IDAD-DNS-09
SeverityInfo
SuiteActive Directory
CategoryAD.DNS
PowerShell testTest-MtAdDnsZoneDelegationDetails
TagsAD, AD-DNS-09, AD.DNS

Source​

  • Pester test: tests/ad/dns/Test-MtAdDnsZoneDelegationDetails.Tests.ps1
  • PowerShell source: powershell/public/ad/dns/Test-MtAdDnsZoneDelegationDetails.ps1