AD-DNS-09: Zone delegation details should be retrievable
| ID | AD-DNS-09 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | DNS |
| Security area | Infrastructure hardening |
| Resource type | DnsZone |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Detailed information about DNS delegations is essential for:
- Security auditing: Understanding what subdomains are delegated and to whom
- Dependency mapping: Knowing which external servers are trusted
- Incident response: Quickly identifying affected delegations during incidents
- Compliance documentation: Maintaining records of DNS infrastructure
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Review delegation details regularly and:
- Verify all target name servers are authorized
- Remove delegations for decommissioned services
- Document the purpose and owner of each delegation
- Implement monitoring for delegation changes
How the Test Works
Section titled “How the Test Works”This test provides detailed information about each zone delegation, including:
- Parent zone name
- Delegated subdomain
- Target name server
Related Tests
Section titled “Related Tests”Test-MtAdDnsZoneDelegationCount- Counts zone delegations
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.