AD-DOM-05 - Domain name standard compliance should be retrievable

Contributed by Michael Soule with Merill FernandoAll contributors →

Overview

Domain names that don't comply with RFC 1123 and RFC 952 standards can cause various problems:

• DNS Resolution Issues: Non-compliant names may not resolve correctly in some DNS implementations
• Certificate Problems: SSL/TLS certificates may not work properly with non-standard domain names
• Application Compatibility: Some applications enforce strict domain name validation
• Interoperability: Issues with cross-forest trusts and external integrations

RFC standards require domain names to:

• Start with a letter or digit
• Contain only letters, digits, and hyphens
• Not exceed 63 characters per label
• Not end with a hyphen

Security Recommendation

• Avoid Non-Standard Characters: Don't use underscores, spaces, or special characters in domain names
• Keep Labels Short: Each domain label should be 63 characters or less
• Plan Renames Carefully: Domain rename is complex; plan during initial deployment
• Document Exceptions: If non-compliant names exist, document the business justification

How the Test Works

This test checks all domain names in the forest against RFC 1123 naming standards. It splits each domain into labels (separated by dots) and validates each label against the standard naming pattern.

Related Tests

• Test-MtAdDomainNameNonStandardDetails - Lists details of non-compliant domain names
• Test-MtAdNetbiosNameStandardCompliance - Checks NetBIOS name compliance

Test Metadata

Field	Value
Test ID	AD-DOM-05
Severity	Info
Suite	Active Directory
Category	AD.Domain
PowerShell test	Test-MtAdDomainNameStandardCompliance
Tags	AD, AD-DOM-05, AD.Domain

Source

• Pester test: tests/ad/domain/Test-MtAdDomainNameStandardCompliance.Tests.ps1
• PowerShell source: powershell/public/ad/domain/Test-MtAdDomainNameStandardCompliance.ps1