Allowed DNS suffixes count should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Domain and forest · All checks

Run this check

Invoke-Maester -TestId AD-DOMS-01

Overview

Allowed DNS suffixes control which DNS domain names can be used when joining computers to an Active Directory domain. This configuration is important for:

• Domain Join Security: Restricting allowed DNS suffixes prevents unauthorized computers from joining the domain with unexpected DNS names
• Namespace Consistency: Ensures that joined computers use DNS names that align with organizational naming conventions
• DNS Hygiene: Prevents DNS namespace pollution from computers with non-standard or unexpected DNS suffixes
• Compliance: Some security frameworks require control over which DNS namespaces can participate in the domain

Control Type

Operational

Security Recommendation

Consider configuring allowed DNS suffixes to enhance security:

1. Define Standard Suffixes: Configure allowed DNS suffixes to match your organization’s standard DNS namespaces
2. Restrict Domain Joins: When allowed DNS suffixes are configured, only computers with matching DNS suffixes can join the domain
3. Document Exceptions: If no suffixes are configured (allowing any), document this decision and the associated risk acceptance
4. Regular Review: Review and update allowed DNS suffixes as the organization’s DNS infrastructure evolves

Note: By default, no allowed DNS suffixes are configured, which permits computers with any DNS suffix to join the domain. While this provides flexibility, it may not meet strict security requirements.

How the Test Works

This test retrieves the allowed DNS suffixes configuration from the domain using Get-ADDomain. It counts the number of configured allowed DNS suffixes and reports the current configuration status. The test helps administrators understand whether domain join restrictions based on DNS suffix are in place.

Related Tests

• Test-MtAdDomainNameStandardCompliance - Checks domain name RFC compliance
• Test-MtAdNetbiosNameStandardCompliance - Checks NetBIOS name compliance

Details

Every attribute of this check

Field	Value
Test ID	AD-DOMS-01
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Domain and forest
Area	Infrastructure hardening
Resource type	Tenant
MITRE ATT&CK	None
PowerShell test	Test-MtAdAllowedDnsSuffixesCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:domainDNS.name:ReadProperty

Source

• Test: tests/ad/domain/Test.AD-DOMS-01.ps1
• Documentation: tests/ad/domain/Test.AD-DOMS-01.md