AD-DNS-01: DNS zone count should be retrievable
| ID | AD-DNS-01 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | DNS |
| Security area | Infrastructure hardening |
| Resource type | DnsZone |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”DNS zones are the primary organizational units for DNS data. Understanding how many zones contain resource records helps assess:
- Infrastructure complexity: More zones indicate a more complex DNS environment
- Administrative boundaries: Zones often represent different administrative domains
- Service distribution: Multiple zones may indicate delegated or distributed services
- Security posture: Unused or empty zones may represent configuration drift
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Regularly audit DNS zones to ensure they are all necessary and properly configured. Remove unused zones and verify that zone delegation follows your organization’s security policies.
How the Test Works
Section titled “How the Test Works”This test retrieves all DNS zones and counts those that contain resource records. It provides:
- Total number of DNS zones
- Count of zones with records
- Count of empty zones
Related Tests
Section titled “Related Tests”Test-MtAdDnsEmptyZoneCount- Identifies zones with no recordsTest-MtAdDnsZonesWithOnlySoaNs- Finds zones with only default records
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.