AD-DNS-16: Reverse lookup zone count should be retrievable
| ID | AD-DNS-16 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | DNS |
| Security area | Infrastructure hardening |
| Resource type | DnsZone |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Reverse lookup zones enable IP-to-name resolution (PTR records) and are essential for:
- Security auditing: Identifying systems by IP address
- Network troubleshooting: Resolving IPs to hostnames
- Application functionality: Many services require reverse DNS
- Compliance: Some regulations require reverse DNS configuration
The number of reverse zones indicates network coverage for reverse resolution.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Maintain reverse zones for all internal networks
- Ensure reverse records are kept synchronized with forward records
- Protect reverse zones from unauthorized modification
- Monitor for unexpected changes to reverse zones
How the Test Works
Section titled “How the Test Works”This test counts reverse lookup zones (zones ending in .in-addr.arpa for IPv4 and .ip6.arpa for IPv6).
Related Tests
Section titled “Related Tests”Test-MtAdDnsReverseZoneNetworkCount- Counts distinct networks with reverse zonesTest-MtAdDnsReverseZoneNetworkDetails- Provides detailed network information
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.