Permission Management For DNS

Given by Henry J Schmale on 2026 October 16

DNS is a cross cutting concern in organizations. It's an old service, and as we know it's always DNS. Presented to DC215 on Oct 7, 2026.

Contents

  1. Definitions and Boundaries
  2. Tools of the Trade
  3. What is DNS
  4. Non-Exhaustive Threat Models in DNS
  5. Spliting Responsiblity in Enterprise
  6. Guardrails

Security and Cross Cutting Concerns

  • Security is about putting up barriers to keep bad things from happening.
  • What is the maximum scope of permissions?
  • How do we segment permissions to limit the blast radius of any given individual?
  • What are the tools of the trade to map these out?

Authentication vs Authorization

Authentication
Are you who you say you are?
Authorization
Are you allowed to do what you are trying to do?

Tools of the Trade

Responsibility Assignment Matrix

Defines stakeholders who are responsible, accountable, consulted or informed for parts of a project or process.

Responsible
Who plans, executes and completes the task. The do-er.
Accountable
Who is going to be taken to task if it succeeds or fails. Approver
Consulted
Who gets input
Informed
Who needs to be told that something is happening

Example Matrix

Across the top you have the stakeholders. Down you have the various tasks. In each cell the role is assigned.

For example, owning a cat and assigning the responsiblities in a family.

Stakeholders

  • Mom (she wanted the cat)
  • Dad
  • Kids
  • The Cat

Tasks

  • Scooping the poop
  • Purchasing Supplies
  • Providing the wet food
  • Refilling dry food
  • Change water
  • Entertain cat
  • Vet Visits

Building the RACI

Task Mom Dad Children Cat
Scooping the poop A A R I/C
Purchasing Supplies R/A R/A C/I
Providing the wet food A R/A I C/I
Refilling dry food A A R
Change water A A R
Entertain cat R R R A
Vet Visits R/A R/A C/I I

Benefits and Issues of the RACI

Benefits

  • Defines clear ownership of tasks
  • Decent modeling tool

Issues

  • Doesn’t explain individual resources or fine grained access
  • Requires knowledge of all the players involved

Domain Name System (DNS)

What is DNS?

  • How does your computer know how to get to a website?
  • The string example.com means nothing to the machine.
  • Addresses are numbers that are meaningful to the other machines, but not people. One address can also host many sites.
  • But these numbers are unpleasant to humans.
  • So we built a mapping database for them called DNS.

Where and How is DNS is used?

  • Email
  • Voice Chat (SIP)
  • Domain Control and Verification

Other Uses

  • Adblocking at the network level (pi hole)

How are domain names resolved?

youISP DNSregistrardnsProviderexample.com Where is example.comWhere should I look for example.com?You should go look at dnsProviderWhere is example.com?It is at X.X.X.XIt is at X.X.X.XMake http request to example.com using X.X.X.X

Hierarchical Nature of DNS

  • Why is your ISP involved here?
  • DNS can have geographical based queries. Routing you to the server closest to you.
  • What happens if your ISP returns bogus responses?
  • Verizon used to redirect NXDOMAIN responses to yahoo.

Record Types in DNS

The records that we care about for the purposes of this presentation. The group of records for a site is a zone.

A/AAAA
An actual ip address
NS
Where to go look for a delgated resource. Who hosts the zone.
TXT
Random notes and used for verification
CNAME
Go look somewhere else for the record. Delegates to a 3rd party.
MX
Where email goes

Who hosts your Authoritative DNS?

It’s where your NS records point.

Yourself
That’s a bold choice for external DNS
Your Registrar (Default)
Generally buying a domain includes free DNS. Cloudflare, Namecheap, Porkbun. However you might only have one login.
A Cloud Provider
Paid add-on service. Existing vendor with known permission model and existing audit trail.
Complete 3rd party
Yet another vendor. May provide organizational access/SSO. Might be legacy.

Security Risks and How to Fix

If an attacker gets your complete zone

  • They know the layout of your resources including internal resources
  • They can identify staging sites

How to Fix

If a records points to a dead resource

  • That zone can be taken over with a phising site.
  • IP Addresses are often in a shared pool with hosting providers.
  • Sometimes CDN distributions can be reused.

Risks

  • Reputational Harm
  • Phising sites
  • Bypass web filter controls for phising emails (the domain looks legit)

How To Fix

  • Review of the resources in play
  • Review of your hosting providers
  • Approval of the hosting providers

(subdomain takeover)

If attacker gains access to your dns panel

  • They can add/change/delete records
  • They can verify your domain for other services.

Risks

  • Reputation harm
  • Destruction of data
  • Outages

How To Fix

  • Audit logs
  • Access control reviews
  • Right size permissions - does someone need the right to modify all zones or only some of them?

What if your ISP is malicious

  • The DNS cache has bad values in it.
  • Your ISP is actively changing responses

Risks

  • Getting redirected to a phishing site
  • Leakage of private traffic, what you are visiting.

How to fix.

  • Implement DNSSEC as a hosting provider
    • Signs records, chain of custody
    • Requires registrar support, not all support
    • If incorrectly signed you can knock your site offline for several days.
  • Don’t use default ISP servers

What does this mean for a business?

  • Registering a domain can have trademark implications
  • Domains need to be renewed every year.
  • Who has access to your domain management solution? Are they employees or contractors?
  • Who has access to records? Are you hosting your DNS yourself or using a 3rd party provider?
  • Do you have a process for reviewing existing records? How often?
  • Do you review which SaaS providers you are pointing at?

Given the risks let’s map out the roles

Who is involved? (Large Company)

  • Active Directory Team
  • Developer
  • Trademark/Legal
  • Regular IT
  • Risk team
  • Security Operations Center

DNS RACI

Task AD Dev Legal IT Risk SOC
Purchase Domain C R/A I I
Update DNS Records A/C R I I
Map Permissions R A I I
Triage Alerts R/A
Review Access Logs R/A C/I
Decommissioning stale DNS entries A R C/I

Could a team request delegation of their zone?

  • What if a team has a fast changing value for their records? (Geo-routing, autoscaling, etc)
  • Should it be possible to delegate control of the zone to them?
  • What permissions are required?

What Guardrails can your team implement?

  • CI/CD of your zones
  • Checking cname records for approved vendors
  • Checking for approved ip address ranges

Appendix

The Hosts File

Described in 1983 for Arpanet. Mapped IP addresses to actual domains. Originally each site would be responsible for their own hosts file. Updates were irregular and randomly distributed.

127.0.0.1   my-awesome-site.com
0.0.0.0     blocked-site.com
# Internal site that must not be assessible externally.
192.168.50.126  accural-engine.important-business.com

Tasks

  1. Who grants access to the domain purchase portal (registrar)?
  2. Who owns new domain purchases?
  3. Who can issue updates to the DNS portal?
  4. Who maps permissions in your environment?
  5. Do you have single sign on?
  6. Who reviews access logs?
  7. Are there alerts? Who receive those alerts?
  8. Are there certain records that must be evaluated before being updated?

This is the end. Thank you for reading or attending.

This post is tagged:

Read more by exploring the posts in the above tags. Otherwise go home.

Hit Counter