# Root servers with incorrect IPs should be retrievable

Root DNS server hints are essential for external DNS resolution. Incorrect root server IP addresses can:

Source: https://maester.dev/docs/tests/AD-DNS-03

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · DNS · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-DNS-03
```

## Overview

Root DNS server hints are essential for external DNS resolution. Incorrect root server IP addresses can:

- **Prevent external DNS resolution**: Clients cannot resolve internet domain names
- **Indicate compromise**: Unexpected changes may indicate DNS poisoning attacks
- **Cause service outages**: Applications dependent on external DNS will fail
- **Impact security updates**: Systems may be unable to reach update servers

The root server IP addresses are maintained by IANA and change very infrequently. Any deviation from the official addresses should be investigated immediately.

#### Control Type

**Detective**

#### Security Recommendation

- Verify root server hints against the official IANA list
- Investigate any discrepancies immediately
- Use secure update mechanisms for root hints
- Monitor for unauthorized changes to DNS configuration

#### How the Test Works

This test compares configured root server IP addresses against the official IANA root server list and reports any discrepancies.

#### Related Tests

- `Test-MtAdDnsRootServerIncorrectDetails` - Provides detailed information about incorrect root servers

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-DNS-03 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | DNS |
| Area | Infrastructure hardening |
| Resource type | DnsZone |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtAdDnsRootServerIncorrectCount](https://github.com/maester365/maester/blob/main/tests/ad/dns/Test.AD-DNS-03.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_Zone:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_ResourceRecord:Read, ActiveDirectory:Cim:root\MicrosoftDNS:MicrosoftDNS_RootHints:Read |

</details>

## Source

- Test: [`tests/ad/dns/Test.AD-DNS-03.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/dns/Test.AD-DNS-03.ps1)
- Documentation: [`tests/ad/dns/Test.AD-DNS-03.md`](https://github.com/maester365/maester/blob/main/tests/ad/dns/Test.AD-DNS-03.md)