AD-DNS-14: Empty zone count should be retrievable
| ID | AD-DNS-14 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | DNS |
| Security area | Infrastructure hardening |
| Resource type | DnsZone |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Empty DNS zones (zones with no resource records) may indicate:
- Incomplete configuration: Zones created but never populated
- Abandoned infrastructure: Services that were planned but never deployed
- Configuration errors: Failed zone creation or replication issues
- Cleanup opportunities: Removing unused zones reduces complexity
Empty zones add administrative overhead without providing value and may confuse administrators.
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”- Audit empty zones regularly
- Delete zones that are no longer needed
- Document the purpose of any intentionally empty zones
- Investigate unexpected empty zones for potential issues
How the Test Works
Section titled “How the Test Works”This test identifies DNS zones that contain zero resource records of any type.
Related Tests
Section titled “Related Tests”Test-MtAdDnsZoneCount- Counts zones with recordsTest-MtAdDnsZonesWithOnlySoaNs- Finds zones with only default records
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.