services / Azure / DNS CAA record set

A CAA (Certification Authority Authorization) record set within an Azure public DNS zone. CAA records declare which certificate authorities are permitted to issue TLS certificates for the domain, acting as a DNS-level trust control.

DNS zones govern a single organizational function's public name resolution and certificate-issuance trust; the CAA restriction is a defense against fraudulent certificate issuance.

Microsoft.​Network/​dnszones/​CAA/​write

Create/update replaces the existing CAA records, letting an attacker authorize a CA they control to issue certificates for the domain (subverting the cert-issuance trust control) and otherwise manipulate the domain's DNS authorization data.

Risks

1. Domain takeover (CRITICAL)
2. Data manipulation (HIGH)
3. Defense destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links