AD-DNS-19: Reverse zone network details should be retrievable
| ID | AD-DNS-19 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | DNS |
| Security area | Infrastructure hardening |
| Resource type | DnsZone |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Detailed information about networks with reverse lookup zones enables:
- Network inventory: Complete list of networks with reverse DNS
- Security auditing: Verification that only authorized networks are configured
- Troubleshooting: Quick identification of reverse DNS coverage
- Documentation: Accurate records of DNS infrastructure
Understanding which networks have reverse zones is essential for comprehensive DNS management.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Review reverse zone network details regularly:
- Verify all listed networks are authorized
- Ensure CIDR notation is appropriate for each network
- Document the purpose of each reverse zone
- Remove reverse zones for decommissioned networks
How the Test Works
Section titled “How the Test Works”This test provides detailed information about each network with a reverse lookup zone, including:
- Network address
- CIDR notation
- Reverse zone name
- Zone type
Related Tests
Section titled “Related Tests”Test-MtAdDnsReverseZoneCount- Counts reverse lookup zonesTest-MtAdDnsReverseZoneNetworkCount- Counts distinct networks
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.