AD-DNS-02: Zones with only SOA/NS records should be retrievable
| ID | AD-DNS-02 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | DNS |
| Security area | Infrastructure hardening |
| Resource type | DnsZone |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”DNS zones that contain only SOA (Start of Authority) and NS (Name Server) records are essentially placeholder zones. These zones:
- May indicate incomplete configuration: Zones created but never populated with actual records
- Could represent abandoned infrastructure: Services that were planned but never deployed
- Might be unnecessary: Adding complexity without providing value
- Can cause confusion: Administrators may assume these zones are actively used
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Review zones with only SOA/NS records and either:
- Populate them with necessary resource records if they serve a purpose
- Delete them if they are no longer needed
- Document their purpose if they are intentionally placeholder zones
How the Test Works
Section titled “How the Test Works”This test identifies DNS zones that contain only SOA and NS records, with no A, AAAA, CNAME, MX, SRV, or other record types.
Related Tests
Section titled “Related Tests”Test-MtAdDnsZoneCount- Counts all zones with recordsTest-MtAdDnsEmptyZoneCount- Finds zones with zero records
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.