services / Azure / DNS CAA record set

A CAA (Certification Authority Authorization) record set within an Azure public DNS zone. CAA records declare which certificate authorities are permitted to issue TLS certificates for the domain, acting as a DNS-level trust control.

DNS zones govern a single organizational function's public name resolution and certificate-issuance trust; the CAA restriction is a defense against fraudulent certificate issuance.

Microsoft.​Network/​dnszones/​CAA/​delete

Deleting the CAA record set removes a DNS network component and tears down the restriction on which CAs may issue certificates for the domain, re-enabling any CA to issue certs.

Risks

1. Domain takeover (CRITICAL)
2. Network destruction (HIGH)
3. Defense destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links