AD-DNS-09 - Zone delegation details should be retrievable
Overview
Detailed information about DNS delegations is essential for:
- Security auditing: Understanding what subdomains are delegated and to whom
- Dependency mapping: Knowing which external servers are trusted
- Incident response: Quickly identifying affected delegations during incidents
- Compliance documentation: Maintaining records of DNS infrastructure
Control Type
Operational
Security Recommendation
Review delegation details regularly and:
- Verify all target name servers are authorized
- Remove delegations for decommissioned services
- Document the purpose and owner of each delegation
- Implement monitoring for delegation changes
How the Test Works
This test provides detailed information about each zone delegation, including:
- Parent zone name
- Delegated subdomain
- Target name server
Related Tests
Test-MtAdDnsZoneDelegationCount- Counts zone delegations
Test Metadata
| Field | Value |
|---|---|
| Test ID | AD-DNS-09 |
| Severity | Info |
| Suite | Active Directory |
| Category | Active Directory - DNS Infrastructure |
| PowerShell test | Test-MtAdDnsZoneDelegationDetails |
| Services | ActiveDirectory |
| Tags | AD, AD-DNS-09, AD.DNS |
Source
- Test:
tests/ad/dns/Test.AD-DNS-09.ps1 - Documentation:
tests/ad/dns/Test.AD-DNS-09.md