AD-DNS-17: Non-standard zone count should be retrievable
| ID | AD-DNS-17 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | DNS |
| Security area | Infrastructure hardening |
| Resource type | DnsZone |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Non-standard DNS zone names (not compliant with RFCs 952, 1035, and 1123) may cause:
- Compatibility issues: Some DNS clients and applications may fail
- Resolution problems: Non-standard names may not resolve correctly
- Management difficulties: Unusual characters can complicate administration
- Security risks: Special characters might be used in injection attacks
Standard DNS names should contain only letters, numbers, and hyphens.
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”- Use only RFC-compliant names for DNS zones
- Rename or remove zones with non-standard names
- Implement naming conventions that follow RFC standards
- Audit zone names regularly for compliance
How the Test Works
Section titled “How the Test Works”This test identifies zones with names that do not comply with RFC standards for internet domain names, excluding special zones like TrustAnchors and _msdcs.
Related Tests
Section titled “Related Tests”- None currently
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.