[ DNS & domains ]
Protect DNS administration with scoped access and change approval
Align effective DNS permissions, record-level change previews and accountable approval without confusing locks with immutable records.
By the EmailAuth research team · 8 min read
[ Key points ]
- Technical permission and approval of a particular DNS change are separate controls.
- Review inherited access as well as the narrow role assignment being proposed.
- Protect complete record sets and understand the limits of deletion locks.
[ Takeaway ]
Give the operator only the supported scope needed for the job, review the exact resulting records and verify the approved change without overstating protection.
[ By role ]
What this means for you
Choose your role for practical next steps.
IT / Mail Admin
Review the whole proposed record set
A small authentication request can overwrite other services at the same owner.
Next steps
- Capture current and proposed complete records.
- Check the issued selector or SPF policy with the sender owner.
- Retain authoritative and message acceptance evidence.
CISO / SecOps
Assess effective authority
A narrow assignment may coexist with broader inherited access.
Next steps
- Review parent-scope and group-derived grants.
- Distinguish permission design from change approval.
- Document what resource locks actually prevent.
Founder / Non-technical
Make DNS changes accountable
A named owner and recovery path matter even in a small team.
Next steps
- Assign request, review and publication responsibilities.
- Approve scope changes rather than vague fixes.
- Require a reversible plan and final service acceptance.
[ FAQs ]
Frequently asked questions
Does a change ticket give someone DNS permissions?
No. Business approval and platform authorization are separate. The publisher needs an approved change and suitable technical authority; neither substitutes for the other.
Does DNS Zone Contributor cover Azure private DNS?
The cited public-DNS guide states that the built-in role manages public DNS resources, not private DNS zones. Review the correct service’s permissions.
Can Azure DNS access be scoped to one record set?
The documentation supports record-set-level assignments. Confirm the actual job and creation requirements rather than assuming access to one existing resource permits arbitrary new names.
Does adding a narrow role remove broader access?
No. Review inherited and other direct assignments. A lower-scope grant does not itself cancel permissions already granted higher in the hierarchy.
Does CanNotDelete prevent an authentication record from disappearing?
Not necessarily. Azure documents that a record set can still be modified until empty, even when resource deletion is blocked. Evaluate the actual operation to prevent.
What does a ReadOnly zone lock prevent in the Azure example?
The cited DNS guidance says it blocks creation of new record sets and modification or deletion of existing sets. Plan legitimate maintenance and exceptions before proposing it.
Should a DKIM ticket include the private key?
No. DNS publishes the corresponding public information or supported lookup delegation. Private signing material does not belong in the public record or change worksheet.
Can a rollback restore the entire old zone without review?
Do not assume that is safe. Later legitimate changes may exist. Review current state and restore the smallest approved scope while preserving unrelated work.
[ Sources ]
Sources
- RFC1034
Sections §4.2 How the database is divided into zones
- RFC7208
Sections §4.5 Selecting Records · §4.6.4 DNS Lookup Limits
- RFC6376
Sections §3.6 Key Management and Representation · §5. Signer Actions · §6. Verifier Actions
- Microsoft: Protecting DNS zones and records
Sections The DNS Zone Contributor role · Zone level Azure RBAC · Record set level Azure RBAC · Custom roles · Resource locks
- Microsoft: Understand scope for Azure RBAC
Sections Scope levels · Scope format
[ Glossary ]
Glossary
- Effective access
- The authority available from the principal’s applicable direct and inherited role assignments.
- Record-set scope
- An access boundary tied to a particular DNS record-set resource.
- Change preview
- The proposed before-and-after record data reviewed for the requested operation.
- Deletion lock
- A control preventing specified resource deletion without necessarily preventing changes to contained DNS records.
Enterprise provenance
Why top financial institutions and governments retired their email security dashboards.
Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.
EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.
SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption