AD-DNS-05: Dynamic DNS record count should be retrievable
| ID | AD-DNS-05 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | DNS |
| Security area | Infrastructure hardening |
| Resource type | DnsZone |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Dynamic DNS allows clients to register and update their own DNS records. While convenient, excessive dynamic registration can indicate:
- Security risks: Unauthorized devices may register in DNS
- Configuration issues: Misconfigured clients may create excessive records
- Stale data: Dynamic records may not be cleaned up properly
- Resource exhaustion: Too many dynamic records can impact DNS performance
Understanding the ratio of dynamic to static records helps assess the security and hygiene of your DNS environment.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Enable secure dynamic updates only (require authentication)
- Implement aging and scavenging to remove stale records
- Monitor for unusual patterns in dynamic registration
- Restrict dynamic updates to authorized systems only
How the Test Works
Section titled “How the Test Works”This test counts DNS records that have timestamps (dynamic) versus those without (static) and reports the ratio.
Related Tests
Section titled “Related Tests”Test-MtAdDnsZoneRecordDetails- Provides detailed record counts per zone
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.