Domain name standard compliance should be retrievable
AD-DOM-05InfoActive DirectoryDomain and forest
Part of Active Directory · Active Directory · Domain and forest · All checks
Invoke-Maester -TestId AD-DOM-05Overview
Section titled “Overview”Domain names that don’t comply with RFC 1123 and RFC 952 standards can cause various problems:
- DNS Resolution Issues: Non-compliant names may not resolve correctly in some DNS implementations
- Certificate Problems: SSL/TLS certificates may not work properly with non-standard domain names
- Application Compatibility: Some applications enforce strict domain name validation
- Interoperability: Issues with cross-forest trusts and external integrations
RFC standards require domain names to:
- Start with a letter or digit
- Contain only letters, digits, and hyphens
- Not exceed 63 characters per label
- Not end with a hyphen
Control Type
Section titled “Control Type”Preventive
Security Recommendation
Section titled “Security Recommendation”- Avoid Non-Standard Characters: Don’t use underscores, spaces, or special characters in domain names
- Keep Labels Short: Each domain label should be 63 characters or less
- Plan Renames Carefully: Domain rename is complex; plan during initial deployment
- Document Exceptions: If non-compliant names exist, document the business justification
How the Test Works
Section titled “How the Test Works”This test checks all domain names in the forest against RFC 1123 naming standards. It splits each domain into labels (separated by dots) and validates each label against the standard naming pattern.
Related Tests
Section titled “Related Tests”Test-MtAdDomainNameNonStandardDetails- Lists details of non-compliant domain namesTest-MtAdNetbiosNameStandardCompliance- Checks NetBIOS name compliance
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-DOM-05 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Domain and forest |
| Area | Infrastructure hardening |
| Resource type | Tenant |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdDomainNameStandardCompliance |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:crossRef:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/domain/Test.AD-DOM-05.ps1 - Documentation:
tests/ad/domain/Test.AD-DOM-05.md