AD-DNS-13: DNSSEC record count should be retrievable
| ID | AD-DNS-13 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | DNS |
| Security area | Infrastructure hardening |
| Resource type | DnsZone |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”DNSSEC (DNS Security Extensions) provides authentication of DNS data through digital signatures. Trust anchors are the starting points for DNSSEC validation:
- Data integrity: DNSSEC prevents DNS spoofing and cache poisoning
- Authentication: Clients can verify DNS responses are authentic
- Compliance: Some regulations require DNSSEC deployment
- Trust establishment: Trust anchors enable validation chains
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Deploy DNSSEC for all externally-facing DNS zones
- Maintain secure trust anchor distribution
- Monitor for DNSSEC validation failures
- Keep DNSSEC keys properly managed and rotated
How the Test Works
Section titled “How the Test Works”This test counts DNSSEC trust anchor records configured in the TrustAnchors zone.
Related Tests
Section titled “Related Tests”- None currently
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.