services / Azure / DNS TLSA record set

A TLSA (DANE) record set in an Azure public DNS zone. TLSA records publish which TLS certificate/public-key is trusted for a service name on the domain.

Public-facing authoritative DNS for a single domain function; write/delete affects which TLS certificates are accepted for the domain's services.

Microsoft.​Network/​dnszones/​TLSA/​write

Creating/updating TLSA/DANE records rebinds which TLS certificate is trusted for the domain, letting an attacker authorize a rogue certificate to intercept/hijack TLS connections and tamper with the certificate-pinning defense.

Risks

1. Domain takeover (CRITICAL)
2. Data manipulation (HIGH)
3. Defense destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links