DNS zone files

Name: DNS zone files
Creator: TestPattern Community
License: https://opensource.org/licenses/MIT

Detects DNS zone files: $ORIGIN/$TTL/SOA directives with resource record lines, especially internal zones with private addresses and internal hostnames. A directive alone is discovery-only.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence: the topic phrase alone is discovery-only; enforcement needs populated structure (a resource record line (owner IN A/AAAA/CNAME/MX/NS/TXT/SRV/PTR with data) or an internal-zone artefact (internal hostname, RFC 1918 address, SOA serial block)), and 85 needs two distinct structures plus independent zone-administration (SOA timers, hostmaster, AXFR, BIND) evidence, so policies, blank forms and training text stay below 75.
Detection quality: Topic verified
Jurisdictions: global
Regulations: Security of Critical Infrastructure Act 2018 (Cth)
Frameworks: ISO 27001, NIST CSF
Data categories: security
Scope: wide
Risk rating: 5
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Compatible

Pattern

\$ORIGIN\s+[A-Za-z0-9.-]{1,253}|\$TTL\s+\d{1,10}|\bIN\s+SOA\s+[A-Za-z0-9.-]{1,253}

Corroborative evidence keywords

refresh, retry, expire, hostmaster, zone transfer, AXFR, named.conf, BIND, split-horizon, serial

Proximity: 300 characters

Should match

$TTL 86400 — Discovery probe (65) - TTL directive only
$ORIGIN harbour.internal. fs01 IN A 10.20.4.10 — Medium-tier probe (75) - directive plus one record
$ORIGIN harbour.internal. $TTL 3600 @ IN SOA ns1.harbour.internal. hostmaster.harbour.internal. ( 2026091801 ; serial 7200 ; refresh 3600 ; retry 1209600 ; expire 3600 ) @ IN NS ns1.harbour.internal. fs01 IN A 10.20.4.10 sqlpay01 IN A 10.20.8.11 mail IN MX 10 mx1.harbour.internal. — High-tier probe (85) - internal zone with SOA serial, several records and timers

Should not match

we met in a meeting room — Lowercase "in a" prose must not match (IN is case-sensitive)
the soa architecture team reviewed it — Lowercase "soa" prose must not match
Policy statement: internal DNS zone files are held only on the primary name servers; $TTL values follow the naming standard. — Policy text with a directive fragment
DNS zone file template $ORIGIN [insert]. host IN A ________ — Blank template
Course module 2: a zone file begins with $ORIGIN and lists records such as www IN A 192.0.2.1. — Training framing

Known false positives

Public zone snippets in DNS tutorials and RFCs. Mitigation: Guidance/training framing and template-exclusion terms (example.com) suppress enforce tiers; 85 needs internal-zone artefacts.