AD-DNS-18: Reverse zone network count should be retrievable
| ID | AD-DNS-18 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | DNS |
| Security area | Infrastructure hardening |
| Resource type | DnsZone |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Understanding how many distinct networks have reverse lookup zones helps:
- Network coverage assessment: Ensure all internal networks have reverse DNS
- IP space management: Understand which networks are configured for reverse resolution
- Security monitoring: Identify gaps in reverse DNS coverage
- Compliance verification: Meet requirements for reverse DNS configuration
Each reverse zone represents a network segment that can be resolved from IP to hostname.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Maintain reverse zones for all production networks
- Ensure consistent coverage across the organization
- Document any networks intentionally without reverse zones
- Monitor for unauthorized reverse zone creation
How the Test Works
Section titled “How the Test Works”This test analyzes reverse lookup zone names to extract and count unique network addresses.
Related Tests
Section titled “Related Tests”Test-MtAdDnsReverseZoneCount- Counts reverse lookup zonesTest-MtAdDnsReverseZoneNetworkDetails- Provides detailed network information
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.