AD-DNS-16 - Reverse lookup zone count should be retrievable

Contributed by Michael SouleAll contributors →

Overview

Reverse lookup zones enable IP-to-name resolution (PTR records) and are essential for:

• Security auditing: Identifying systems by IP address
• Network troubleshooting: Resolving IPs to hostnames
• Application functionality: Many services require reverse DNS
• Compliance: Some regulations require reverse DNS configuration

The number of reverse zones indicates network coverage for reverse resolution.

Control Type

Operational

Security Recommendation

• Maintain reverse zones for all internal networks
• Ensure reverse records are kept synchronized with forward records
• Protect reverse zones from unauthorized modification
• Monitor for unexpected changes to reverse zones

How the Test Works

This test counts reverse lookup zones (zones ending in .in-addr.arpa for IPv4 and .ip6.arpa for IPv6).

Related Tests

• Test-MtAdDnsReverseZoneNetworkCount - Counts distinct networks with reverse zones
• Test-MtAdDnsReverseZoneNetworkDetails - Provides detailed network information

Test Metadata

Field	Value
Test ID	AD-DNS-16
Severity	Info
Suite	Active Directory
Category	Active Directory - DNS Infrastructure
PowerShell test	Test-MtAdDnsReverseZoneCount
Services	ActiveDirectory
Tags	AD, AD-DNS-16, AD.DNS

Source

• Test: tests/ad/dns/Test.AD-DNS-16.ps1
• Documentation: tests/ad/dns/Test.AD-DNS-16.md