AD-DOMS-01 - Allowed DNS suffixes count should be retrievable

Contributed by Michael Soule with Merill FernandoAll contributors →

Overview

Allowed DNS suffixes control which DNS domain names can be used when joining computers to an Active Directory domain. This configuration is important for:

• Domain Join Security: Restricting allowed DNS suffixes prevents unauthorized computers from joining the domain with unexpected DNS names
• Namespace Consistency: Ensures that joined computers use DNS names that align with organizational naming conventions
• DNS Hygiene: Prevents DNS namespace pollution from computers with non-standard or unexpected DNS suffixes
• Compliance: Some security frameworks require control over which DNS namespaces can participate in the domain

Security Recommendation

Consider configuring allowed DNS suffixes to enhance security:

1. Define Standard Suffixes: Configure allowed DNS suffixes to match your organization's standard DNS namespaces
2. Restrict Domain Joins: When allowed DNS suffixes are configured, only computers with matching DNS suffixes can join the domain
3. Document Exceptions: If no suffixes are configured (allowing any), document this decision and the associated risk acceptance
4. Regular Review: Review and update allowed DNS suffixes as the organization's DNS infrastructure evolves

Note: By default, no allowed DNS suffixes are configured, which permits computers with any DNS suffix to join the domain. While this provides flexibility, it may not meet strict security requirements.

How the Test Works

This test retrieves the allowed DNS suffixes configuration from the domain using Get-ADDomain. It counts the number of configured allowed DNS suffixes and reports the current configuration status. The test helps administrators understand whether domain join restrictions based on DNS suffix are in place.

Related Tests

• Test-MtAdDomainNameStandardCompliance - Checks domain name RFC compliance
• Test-MtAdNetbiosNameStandardCompliance - Checks NetBIOS name compliance

Test Metadata

Field	Value
Test ID	AD-DOMS-01
Severity	Info
Suite	Active Directory
Category	AD.Domain
PowerShell test	Test-MtAdAllowedDnsSuffixesCount
Tags	AD, AD-DOMS-01, AD.Domain

Source

• Pester test: tests/ad/domain/Test-MtAdAllowedDnsSuffixesCount.Tests.ps1
• PowerShell source: powershell/public/ad/domain/Test-MtAdAllowedDnsSuffixesCount.ps1