SOA record details should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · DNS · All checks

Run this check

Invoke-Maester -TestId AD-DNS-10

Overview

SOA (Start of Authority) records contain critical zone management parameters:

• Primary server: The authoritative source for zone data
• Responsible party: Contact information for zone administration
• Serial number: Used for zone transfer synchronization
• Refresh/Retry/Expire: Controls secondary server behavior

Incorrect SOA settings can cause:

• Zone transfer failures
• DNS resolution delays
• Inconsistent data across servers
• Administrative confusion

Control Type

Operational

Security Recommendation

• Ensure primary server values point to valid, secured DNS servers
• Use appropriate contact information that reaches responsible administrators
• Monitor serial numbers for unexpected changes
• Set appropriate TTL values to balance performance and flexibility

How the Test Works

This test retrieves SOA record details for each zone, including primary server, responsible party, serial number, and timing parameters.

Related Tests

• Test-MtAdDnsZonesWithOnlySoaNs - Identifies zones with only SOA/NS records

Details

Every attribute of this check

Field	Value
Test ID	AD-DNS-10
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	DNS
Area	Infrastructure hardening
Resource type	DnsZone
MITRE ATT&CK	None
PowerShell test	Test-MtAdDnsSoaDetails
Services	ActiveDirectory
Permissions	ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read

Source

• Test: tests/ad/dns/Test.AD-DNS-10.ps1
• Documentation: tests/ad/dns/Test.AD-DNS-10.md