Skip to main content
Version: 2.2.1-preview

AD-DNS-18 - Reverse zone network count should be retrievable

Michael SouleMerill Fernando
Contributed by Michael Soule with Merill FernandoAll contributors →

Overview​

Understanding how many distinct networks have reverse lookup zones helps:

  • Network coverage assessment: Ensure all internal networks have reverse DNS
  • IP space management: Understand which networks are configured for reverse resolution
  • Security monitoring: Identify gaps in reverse DNS coverage
  • Compliance verification: Meet requirements for reverse DNS configuration

Each reverse zone represents a network segment that can be resolved from IP to hostname.

Security Recommendation​

  • Maintain reverse zones for all production networks
  • Ensure consistent coverage across the organization
  • Document any networks intentionally without reverse zones
  • Monitor for unauthorized reverse zone creation

How the Test Works​

This test analyzes reverse lookup zone names to extract and count unique network addresses.

  • Test-MtAdDnsReverseZoneCount - Counts reverse lookup zones
  • Test-MtAdDnsReverseZoneNetworkDetails - Provides detailed network information

Test Metadata​

FieldValue
Test IDAD-DNS-18
SeverityInfo
SuiteActive Directory
CategoryAD.DNS
PowerShell testTest-MtAdDnsReverseZoneNetworkCount
TagsAD, AD-DNS-18, AD.DNS

Source​

  • Pester test: tests/ad/dns/Test-MtAdDnsReverseZoneNetworkCount.Tests.ps1
  • PowerShell source: powershell/public/ad/dns/Test-MtAdDnsReverseZoneNetworkCount.ps1