Reverse lookup zone count should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · DNS · All checks

Run this check

Invoke-Maester -TestId AD-DNS-16

Overview

Reverse lookup zones enable IP-to-name resolution (PTR records) and are essential for:

• Security auditing: Identifying systems by IP address
• Network troubleshooting: Resolving IPs to hostnames
• Application functionality: Many services require reverse DNS
• Compliance: Some regulations require reverse DNS configuration

The number of reverse zones indicates network coverage for reverse resolution.

Control Type

Operational

Security Recommendation

• Maintain reverse zones for all internal networks
• Ensure reverse records are kept synchronized with forward records
• Protect reverse zones from unauthorized modification
• Monitor for unexpected changes to reverse zones

How the Test Works

This test counts reverse lookup zones (zones ending in .in-addr.arpa for IPv4 and .ip6.arpa for IPv6).

Related Tests

• Test-MtAdDnsReverseZoneNetworkCount - Counts distinct networks with reverse zones
• Test-MtAdDnsReverseZoneNetworkDetails - Provides detailed network information

Details

Every attribute of this check

Field	Value
Test ID	AD-DNS-16
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	DNS
Area	Infrastructure hardening
Resource type	DnsZone
MITRE ATT&CK	None
PowerShell test	Test-MtAdDnsReverseZoneCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read

Source

• Test: tests/ad/dns/Test.AD-DNS-16.ps1
• Documentation: tests/ad/dns/Test.AD-DNS-16.md