DNSSEC record count should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · DNS · All checks

Run this check

Invoke-Maester -TestId AD-DNS-13

Overview

DNSSEC (DNS Security Extensions) provides authentication of DNS data through digital signatures. Trust anchors are the starting points for DNSSEC validation:

• Data integrity: DNSSEC prevents DNS spoofing and cache poisoning
• Authentication: Clients can verify DNS responses are authentic
• Compliance: Some regulations require DNSSEC deployment
• Trust establishment: Trust anchors enable validation chains

Control Type

Operational

Security Recommendation

• Deploy DNSSEC for all externally-facing DNS zones
• Maintain secure trust anchor distribution
• Monitor for DNSSEC validation failures
• Keep DNSSEC keys properly managed and rotated

How the Test Works

This test counts DNSSEC trust anchor records configured in the TrustAnchors zone.

Related Tests

• None currently

Details

Every attribute of this check

Field	Value
Test ID	AD-DNS-13
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	DNS
Area	Infrastructure hardening
Resource type	DnsZone
MITRE ATT&CK	None
PowerShell test	Test-MtAdDnsDnssecRecordCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read

Source

• Test: tests/ad/dns/Test.AD-DNS-13.ps1
• Documentation: tests/ad/dns/Test.AD-DNS-13.md