Reverse zone network count should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · DNS · All checks

Run this check

Invoke-Maester -TestId AD-DNS-18

Overview

Understanding how many distinct networks have reverse lookup zones helps:

• Network coverage assessment: Ensure all internal networks have reverse DNS
• IP space management: Understand which networks are configured for reverse resolution
• Security monitoring: Identify gaps in reverse DNS coverage
• Compliance verification: Meet requirements for reverse DNS configuration

Each reverse zone represents a network segment that can be resolved from IP to hostname.

Control Type

Operational

Security Recommendation

• Maintain reverse zones for all production networks
• Ensure consistent coverage across the organization
• Document any networks intentionally without reverse zones
• Monitor for unauthorized reverse zone creation

How the Test Works

This test analyzes reverse lookup zone names to extract and count unique network addresses.

Related Tests

• Test-MtAdDnsReverseZoneCount - Counts reverse lookup zones
• Test-MtAdDnsReverseZoneNetworkDetails - Provides detailed network information

Details

Every attribute of this check

Field	Value
Test ID	AD-DNS-18
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	DNS
Area	Infrastructure hardening
Resource type	DnsZone
MITRE ATT&CK	None
PowerShell test	Test-MtAdDnsReverseZoneNetworkCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read

Source

• Test: tests/ad/dns/Test.AD-DNS-18.ps1
• Documentation: tests/ad/dns/Test.AD-DNS-18.md