services / Azure / DNS PTR record set

Azure DNS PTR (reverse-DNS) record set mapping IP addresses back to hostnames within a DNS zone. Used for reverse lookups that services such as mail acceptance rely on.

Write access lets an attacker control reverse-DNS resolution to spoof identity/bypass reverse-lookup checks; delete disrupts reverse-lookup-dependent services.

Microsoft.​Network/​dnszones/​PTR/​write

Creating/replacing the PTR record set lets an attacker control reverse-DNS resolution to spoof trusted hostnames (e.g. for mail reputation/FCrDNS) and manipulate routing-adjacent trust data.

Risks

1. Domain takeover (CRITICAL)
2. Data manipulation (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links