# Domain name standard compliance should be retrievable

Domain names that don't comply with RFC 1123 and RFC 952 standards can cause various problems:

Source: https://maester.dev/docs/tests/AD-DOM-05

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Domain and forest · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-DOM-05
```

## Overview

Domain names that don't comply with RFC 1123 and RFC 952 standards can cause various problems:

- **DNS Resolution Issues**: Non-compliant names may not resolve correctly in some DNS implementations
- **Certificate Problems**: SSL/TLS certificates may not work properly with non-standard domain names
- **Application Compatibility**: Some applications enforce strict domain name validation
- **Interoperability**: Issues with cross-forest trusts and external integrations

RFC standards require domain names to:
- Start with a letter or digit
- Contain only letters, digits, and hyphens
- Not exceed 63 characters per label
- Not end with a hyphen

#### Control Type

**Preventive**

#### Security Recommendation

- **Avoid Non-Standard Characters**: Don't use underscores, spaces, or special characters in domain names
- **Keep Labels Short**: Each domain label should be 63 characters or less
- **Plan Renames Carefully**: Domain rename is complex; plan during initial deployment
- **Document Exceptions**: If non-compliant names exist, document the business justification

#### How the Test Works

This test checks all domain names in the forest against RFC 1123 naming standards. It splits each domain into labels (separated by dots) and validates each label against the standard naming pattern.

#### Related Tests

- `Test-MtAdDomainNameNonStandardDetails` - Lists details of non-compliant domain names
- `Test-MtAdNetbiosNameStandardCompliance` - Checks NetBIOS name compliance

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-DOM-05 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Domain and forest |
| Area | Infrastructure hardening |
| Resource type | Tenant |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtAdDomainNameStandardCompliance](https://github.com/maester365/maester/blob/main/tests/ad/domain/Test.AD-DOM-05.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:crossRef:ReadProperty |

</details>

## Source

- Test: [`tests/ad/domain/Test.AD-DOM-05.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/domain/Test.AD-DOM-05.ps1)
- Documentation: [`tests/ad/domain/Test.AD-DOM-05.md`](https://github.com/maester365/maester/blob/main/tests/ad/domain/Test.AD-DOM-05.md)