Skip to main content
Version: 2.2.1-preview

AD-DNS-10 - SOA record details should be retrievable

Michael SouleMerill Fernando
Contributed by Michael Soule with Merill FernandoAll contributors →

Overview​

SOA (Start of Authority) records contain critical zone management parameters:

  • Primary server: The authoritative source for zone data
  • Responsible party: Contact information for zone administration
  • Serial number: Used for zone transfer synchronization
  • Refresh/Retry/Expire: Controls secondary server behavior

Incorrect SOA settings can cause:

  • Zone transfer failures
  • DNS resolution delays
  • Inconsistent data across servers
  • Administrative confusion

Security Recommendation​

  • Ensure primary server values point to valid, secured DNS servers
  • Use appropriate contact information that reaches responsible administrators
  • Monitor serial numbers for unexpected changes
  • Set appropriate TTL values to balance performance and flexibility

How the Test Works​

This test retrieves SOA record details for each zone, including primary server, responsible party, serial number, and timing parameters.

  • Test-MtAdDnsZonesWithOnlySoaNs - Identifies zones with only SOA/NS records

Test Metadata​

FieldValue
Test IDAD-DNS-10
SeverityInfo
SuiteActive Directory
CategoryAD.DNS
PowerShell testTest-MtAdDnsSoaDetails
TagsAD, AD-DNS-10, AD.DNS

Source​

  • Pester test: tests/ad/dns/Test-MtAdDnsSoaDetails.Tests.ps1
  • PowerShell source: powershell/public/ad/dns/Test-MtAdDnsSoaDetails.ps1