AD-DNS-19 - Reverse zone network details should be retrievable
Overview
Detailed information about networks with reverse lookup zones enables:
- Network inventory: Complete list of networks with reverse DNS
- Security auditing: Verification that only authorized networks are configured
- Troubleshooting: Quick identification of reverse DNS coverage
- Documentation: Accurate records of DNS infrastructure
Understanding which networks have reverse zones is essential for comprehensive DNS management.
Control Type
Operational
Security Recommendation
Review reverse zone network details regularly:
- Verify all listed networks are authorized
- Ensure CIDR notation is appropriate for each network
- Document the purpose of each reverse zone
- Remove reverse zones for decommissioned networks
How the Test Works
This test provides detailed information about each network with a reverse lookup zone, including:
- Network address
- CIDR notation
- Reverse zone name
- Zone type
Related Tests
Test-MtAdDnsReverseZoneCount- Counts reverse lookup zonesTest-MtAdDnsReverseZoneNetworkCount- Counts distinct networks
Test Metadata
| Field | Value |
|---|---|
| Test ID | AD-DNS-19 |
| Severity | Info |
| Suite | Active Directory |
| Category | Active Directory - DNS Infrastructure |
| PowerShell test | Test-MtAdDnsReverseZoneNetworkDetails |
| Services | ActiveDirectory |
| Tags | AD, AD-DNS-19, AD.DNS |
Source
- Test:
tests/ad/dns/Test.AD-DNS-19.ps1 - Documentation:
tests/ad/dns/Test.AD-DNS-19.md