services / Azure / DNS DS record set

A DS (Delegation Signer) record set in an Azure public DNS zone. DS records publish the hash of a delegated child zone's signing key, anchoring the DNSSEC chain of trust for that delegation.

Public-facing authoritative DNS for a single domain function; write/delete affects DNSSEC validation and resolution trust for delegated subdomains.

Microsoft.​Network/​dnszones/​DS/​delete

Deleting the DS record set removes a public DNS network component and the DNSSEC delegation trust anchor, breaking validation for delegated subzones and enabling spoofing/redirection.

Risks

1. Network destruction (HIGH)
2. Defense destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links