services / Azure / DNS PTR record set

Azure DNS PTR (reverse-DNS) record set mapping IP addresses back to hostnames within a DNS zone. Used for reverse lookups that services such as mail acceptance rely on.

Write access lets an attacker control reverse-DNS resolution to spoof identity/bypass reverse-lookup checks; delete disrupts reverse-lookup-dependent services.

Microsoft.​Network/​dnszones/​PTR/​delete

Deleting the PTR record set removes reverse-DNS resolution, destroying a network component and disrupting services (e.g. mail acceptance) that depend on reverse lookups.

Risks

1. Denial-of-service (HIGH)
2. Network destruction (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links