services / Azure / DNS DS record set

A DS (Delegation Signer) record set in an Azure public DNS zone. DS records publish the hash of a delegated child zone's signing key, anchoring the DNSSEC chain of trust for that delegation.

Public-facing authoritative DNS for a single domain function; write/delete affects DNSSEC validation and resolution trust for delegated subdomains.

Microsoft.​Network/​dnszones/​DS/​write

Creating/updating DS records alters the DNSSEC chain of trust for delegated subzones, enabling an attacker to control/subvert secure resolution of the delegated domain and tamper with the validation defense.

Risks

1. Domain takeover (CRITICAL)
2. Data manipulation (HIGH)
3. Defense destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links