AD-DNS-10: SOA record details should be retrievable
| ID | AD-DNS-10 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | DNS |
| Security area | Infrastructure hardening |
| Resource type | DnsZone |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”SOA (Start of Authority) records contain critical zone management parameters:
- Primary server: The authoritative source for zone data
- Responsible party: Contact information for zone administration
- Serial number: Used for zone transfer synchronization
- Refresh/Retry/Expire: Controls secondary server behavior
Incorrect SOA settings can cause:
- Zone transfer failures
- DNS resolution delays
- Inconsistent data across servers
- Administrative confusion
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Ensure primary server values point to valid, secured DNS servers
- Use appropriate contact information that reaches responsible administrators
- Monitor serial numbers for unexpected changes
- Set appropriate TTL values to balance performance and flexibility
How the Test Works
Section titled “How the Test Works”This test retrieves SOA record details for each zone, including primary server, responsible party, serial number, and timing parameters.
Related Tests
Section titled “Related Tests”Test-MtAdDnsZonesWithOnlySoaNs- Identifies zones with only SOA/NS records
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.