AD-DOM-05: Domain name standard compliance should be retrievable


ID	`AD-DOM-05`
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Domain and forest
Security area	Infrastructure hardening
Resource type	Tenant
Reads from	On-premises Active Directory

What this checks and how to fix it

Domain names that don’t comply with RFC 1123 and RFC 952 standards can cause various problems:

DNS Resolution Issues: Non-compliant names may not resolve correctly in some DNS implementations
Certificate Problems: SSL/TLS certificates may not work properly with non-standard domain names
Application Compatibility: Some applications enforce strict domain name validation
Interoperability: Issues with cross-forest trusts and external integrations

RFC standards require domain names to:

Start with a letter or digit
Contain only letters, digits, and hyphens
Not exceed 63 characters per label
Not end with a hyphen

Control Type

Preventive

Security Recommendation

Avoid Non-Standard Characters: Don’t use underscores, spaces, or special characters in domain names
Keep Labels Short: Each domain label should be 63 characters or less
Plan Renames Carefully: Domain rename is complex; plan during initial deployment
Document Exceptions: If non-compliant names exist, document the business justification

How the Test Works

This test checks all domain names in the forest against RFC 1123 naming standards. It splits each domain into labels (separated by dots) and validates each label against the standard naming pattern.

Test-MtAdDomainNameNonStandardDetails - Lists details of non-compliant domain names
Test-MtAdNetbiosNameStandardCompliance - Checks NetBIOS name compliance

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).