AD-DNS-04: Root server incorrect IP details should be retrievable
| ID | AD-DNS-04 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | DNS |
| Security area | Infrastructure hardening |
| Resource type | DnsZone |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Detailed information about incorrect root server configurations is essential for:
- Rapid remediation: Knowing exactly which servers are misconfigured enables quick fixes
- Root cause analysis: Understanding the scope helps identify how the misconfiguration occurred
- Security incident response: Unexpected changes may indicate compromise or attack
- Compliance documentation: Detailed records support audit requirements
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”When incorrect root server IPs are detected:
- Document all discrepancies
- Update root hints to match official IANA addresses
- Investigate the cause of the discrepancy
- Implement monitoring to detect future unauthorized changes
How the Test Works
Section titled “How the Test Works”This test provides detailed information about each root server that has an incorrect IP address, including:
- Configured IP address
- Expected (correct) IP address
- Status of all root servers
Related Tests
Section titled “Related Tests”Test-MtAdDnsRootServerIncorrectCount- Counts root servers with incorrect IPs
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.