AD-DNS-03: Root servers with incorrect IPs should be retrievable
| ID | AD-DNS-03 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | DNS |
| Security area | Infrastructure hardening |
| Resource type | DnsZone |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Root DNS server hints are essential for external DNS resolution. Incorrect root server IP addresses can:
- Prevent external DNS resolution: Clients cannot resolve internet domain names
- Indicate compromise: Unexpected changes may indicate DNS poisoning attacks
- Cause service outages: Applications dependent on external DNS will fail
- Impact security updates: Systems may be unable to reach update servers
The root server IP addresses are maintained by IANA and change very infrequently. Any deviation from the official addresses should be investigated immediately.
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”- Verify root server hints against the official IANA list
- Investigate any discrepancies immediately
- Use secure update mechanisms for root hints
- Monitor for unauthorized changes to DNS configuration
How the Test Works
Section titled “How the Test Works”This test compares configured root server IP addresses against the official IANA root server list and reports any discrepancies.
Related Tests
Section titled “Related Tests”Test-MtAdDnsRootServerIncorrectDetails- Provides detailed information about incorrect root servers
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.