# Allowed DNS suffixes count should be retrievable

Allowed DNS suffixes control which DNS domain names can be used when joining computers to an Active Directory domain. This configuration is important for:

Source: https://maester.dev/docs/tests/AD-DOMS-01

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Domain and forest · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-DOMS-01
```

## Overview

Allowed DNS suffixes control which DNS domain names can be used when joining computers to an Active Directory domain. This configuration is important for:

- **Domain Join Security**: Restricting allowed DNS suffixes prevents unauthorized computers from joining the domain with unexpected DNS names
- **Namespace Consistency**: Ensures that joined computers use DNS names that align with organizational naming conventions
- **DNS Hygiene**: Prevents DNS namespace pollution from computers with non-standard or unexpected DNS suffixes
- **Compliance**: Some security frameworks require control over which DNS namespaces can participate in the domain

#### Control Type

**Operational**

#### Security Recommendation

Consider configuring allowed DNS suffixes to enhance security:

1. **Define Standard Suffixes**: Configure allowed DNS suffixes to match your organization's standard DNS namespaces
2. **Restrict Domain Joins**: When allowed DNS suffixes are configured, only computers with matching DNS suffixes can join the domain
3. **Document Exceptions**: If no suffixes are configured (allowing any), document this decision and the associated risk acceptance
4. **Regular Review**: Review and update allowed DNS suffixes as the organization's DNS infrastructure evolves

**Note:** By default, no allowed DNS suffixes are configured, which permits computers with any DNS suffix to join the domain. While this provides flexibility, it may not meet strict security requirements.

#### How the Test Works

This test retrieves the allowed DNS suffixes configuration from the domain using `Get-ADDomain`. It counts the number of configured allowed DNS suffixes and reports the current configuration status. The test helps administrators understand whether domain join restrictions based on DNS suffix are in place.

#### Related Tests

- `Test-MtAdDomainNameStandardCompliance` - Checks domain name RFC compliance
- `Test-MtAdNetbiosNameStandardCompliance` - Checks NetBIOS name compliance

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-DOMS-01 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Domain and forest |
| Area | Infrastructure hardening |
| Resource type | Tenant |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtAdAllowedDnsSuffixesCount](https://github.com/maester365/maester/blob/main/tests/ad/domain/Test.AD-DOMS-01.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:domainDNS.name:ReadProperty |

</details>

## Source

- Test: [`tests/ad/domain/Test.AD-DOMS-01.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/domain/Test.AD-DOMS-01.ps1)
- Documentation: [`tests/ad/domain/Test.AD-DOMS-01.md`](https://github.com/maester365/maester/blob/main/tests/ad/domain/Test.AD-DOMS-01.md)