Skip to content
MitoMito Docs

AD-DCOMP-08: Computer DNS zone count should be investigated
ID AD-DCOMP-08
Severity Info
Suite Active Directory (on-premises)
Product Active Directory
Feature Computers
Security area Infrastructure hardening
Resource type DnsZone
Reads from On-premises Active Directory

What this checks and how to fix it

Section titled “What this checks and how to fix it”
  • Understanding DNS zone distribution across domain computers helps identify network topology, disjoint namespace configurations, and potential DNS-related security issues.

Security and Operational Insights:

  • Disjoint Namespaces: Multiple DNS zones may indicate disjoint namespace configurations
  • Multi-Domain Environments: Helps understand domain and forest structure
  • DNS Security: Identifies zones that need DNSSEC or other security measures
  • Network Segmentation: May reveal network segmentation or perimeter boundaries

Common Scenarios:

  • Single-domain environments typically have one DNS zone
  • Multi-domain forests have multiple zones
  • Disjoint namespaces require special configuration
  • External DNS zones for perimeter networks

Control Type

Section titled “Control Type”

Operational

Security Recommendation

Section titled “Security Recommendation”

  1. Validate Zone Configuration:

    • Ensure all DNS zones are intentional and documented
    • Review disjoint namespace configurations
    • Verify DNS zone delegation is correct

  2. DNS Security:

    • Enable DNSSEC for all DNS zones
    • Implement secure dynamic updates
    • Monitor for unauthorized zone transfers

  3. Documentation:

    • Document all DNS zones and their purposes
    • Maintain network topology diagrams
    • Review during security audits

How the Test Works

Section titled “How the Test Works”

This test extracts DNS zones from computer dNSHostName attributes and:

  • Counts unique DNS zones
  • Lists all zones in use
  • Identifies computers without DNS host names
Section titled “Related Tests”
  • Test-MtAdComputerDnsHostNameCount - DNS host name coverage
  • Test-MtAdComputerDnsZoneDetails - Detailed zone breakdown
  • Test-MtAdDnsZoneCount - DNS server zone analysis

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.