Reverse zone network details should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · DNS · All checks

Run this check

Invoke-Maester -TestId AD-DNS-19

Overview

Detailed information about networks with reverse lookup zones enables:

• Network inventory: Complete list of networks with reverse DNS
• Security auditing: Verification that only authorized networks are configured
• Troubleshooting: Quick identification of reverse DNS coverage
• Documentation: Accurate records of DNS infrastructure

Understanding which networks have reverse zones is essential for comprehensive DNS management.

Control Type

Operational

Security Recommendation

Review reverse zone network details regularly:

• Verify all listed networks are authorized
• Ensure CIDR notation is appropriate for each network
• Document the purpose of each reverse zone
• Remove reverse zones for decommissioned networks

How the Test Works

This test provides detailed information about each network with a reverse lookup zone, including:

• Network address
• CIDR notation
• Reverse zone name
• Zone type

Related Tests

• Test-MtAdDnsReverseZoneCount - Counts reverse lookup zones
• Test-MtAdDnsReverseZoneNetworkCount - Counts distinct networks

Details

Every attribute of this check

Field	Value
Test ID	AD-DNS-19
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	DNS
Area	Infrastructure hardening
Resource type	DnsZone
MITRE ATT&CK	None
PowerShell test	Test-MtAdDnsReverseZoneNetworkDetails
Services	ActiveDirectory
Permissions	ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read

Source

• Test: tests/ad/dns/Test.AD-DNS-19.ps1
• Documentation: tests/ad/dns/Test.AD-DNS-19.md