AD-DOMS-01: Allowed DNS suffixes count should be retrievable
| ID | AD-DOMS-01 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Domain and forest |
| Security area | Infrastructure hardening |
| Resource type | Tenant |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Allowed DNS suffixes control which DNS domain names can be used when joining computers to an Active Directory domain. This configuration is important for:
- Domain Join Security: Restricting allowed DNS suffixes prevents unauthorized computers from joining the domain with unexpected DNS names
- Namespace Consistency: Ensures that joined computers use DNS names that align with organizational naming conventions
- DNS Hygiene: Prevents DNS namespace pollution from computers with non-standard or unexpected DNS suffixes
- Compliance: Some security frameworks require control over which DNS namespaces can participate in the domain
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Consider configuring allowed DNS suffixes to enhance security:
- Define Standard Suffixes: Configure allowed DNS suffixes to match your organization’s standard DNS namespaces
- Restrict Domain Joins: When allowed DNS suffixes are configured, only computers with matching DNS suffixes can join the domain
- Document Exceptions: If no suffixes are configured (allowing any), document this decision and the associated risk acceptance
- Regular Review: Review and update allowed DNS suffixes as the organization’s DNS infrastructure evolves
Note: By default, no allowed DNS suffixes are configured, which permits computers with any DNS suffix to join the domain. While this provides flexibility, it may not meet strict security requirements.
How the Test Works
Section titled “How the Test Works”This test retrieves the allowed DNS suffixes configuration from the domain using Get-ADDomain. It counts the number of configured allowed DNS suffixes and reports the current configuration status. The test helps administrators understand whether domain join restrictions based on DNS suffix are in place.
Related Tests
Section titled “Related Tests”Test-MtAdDomainNameStandardCompliance- Checks domain name RFC complianceTest-MtAdNetbiosNameStandardCompliance- Checks NetBIOS name compliance
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.