Non-standard zone count should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · DNS · All checks

Run this check

Invoke-Maester -TestId AD-DNS-17

Overview

Non-standard DNS zone names (not compliant with RFCs 952, 1035, and 1123) may cause:

• Compatibility issues: Some DNS clients and applications may fail
• Resolution problems: Non-standard names may not resolve correctly
• Management difficulties: Unusual characters can complicate administration
• Security risks: Special characters might be used in injection attacks

Standard DNS names should contain only letters, numbers, and hyphens.

Control Type

Detective

Security Recommendation

• Use only RFC-compliant names for DNS zones
• Rename or remove zones with non-standard names
• Implement naming conventions that follow RFC standards
• Audit zone names regularly for compliance

How the Test Works

This test identifies zones with names that do not comply with RFC standards for internet domain names, excluding special zones like TrustAnchors and _msdcs.

Related Tests

• None currently

Details

Every attribute of this check

Field	Value
Test ID	AD-DNS-17
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	DNS
Area	Infrastructure hardening
Resource type	DnsZone
MITRE ATT&CK	None
PowerShell test	Test-MtAdDnsNonStandardZoneCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read

Source

• Test: tests/ad/dns/Test.AD-DNS-17.ps1
• Documentation: tests/ad/dns/Test.AD-DNS-17.md