AD-DNS-06: Zones with non-default records should be retrievable
| ID | AD-DNS-06 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | DNS |
| Security area | Infrastructure hardening |
| Resource type | DnsZone |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Zones with non-default records (beyond SOA and NS) are actively used for DNS resolution. Understanding which zones contain actual service records helps:
- Identify active services: Zones with records indicate active DNS services
- Assess attack surface: More active zones mean more potential targets
- Plan maintenance: Active zones require more careful change management
- Audit compliance: Verify only authorized zones are in use
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Regularly review zones with non-default records to ensure they are all necessary and properly secured. Verify that zone contents align with authorized services and applications.
How the Test Works
Section titled “How the Test Works”This test identifies DNS zones that contain records beyond the default SOA and NS records, excluding special zones like RootDNSServers and reverse lookup zones.
Related Tests
Section titled “Related Tests”Test-MtAdDnsZoneCount- Counts all zones with recordsTest-MtAdDnsZonesWithOnlySoaNs- Finds zones with only default records
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.