services / Azure / DNS TXT record set

An authoritative DNS TXT record set within an Azure public DNS zone. TXT records hold free-form text used for SPF/DKIM/DMARC email-authentication policy and third-party domain-ownership verification tokens.

DNS record data is published and resolvable by design (public), but write/delete control over it governs how an organizational domain attests trust and routes mail/services.

Microsoft.​Network/​dnszones/​TXT/​write

Creating/replacing TXT records lets an attacker forge domain-ownership verification tokens (to issue certs or claim SaaS tenants) and rewrite SPF/DKIM/DMARC, asserting control over the domain's trust attestation and email-auth posture.

Risks

1. Domain takeover (CRITICAL)
2. Data manipulation (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links