Share via


Securing DNS Resource Records

Applies To: Windows Server 2008

The following Domain Name System (DNS) resource record configuration options have security implications for resource records that are stored in both standard DNS zones and Active Directory–integrated DNS zones:

Manage the DACL on DNS resource records that are stored in Active Directory Domain Services

You can use the discretionary access control list (DACL) to control the permissions for the Active Directory users and groups that may control the DNS resource records. For more information, see Modify Security for a Resource Record.

The following table lists the default group or user names and permissions for DNS resource records that are stored in Active Directory Domain Services (AD DS).

Group or user names Permissions

Administrators

Allow: Read, Write, Create All Child objects, Special Permissions

Authenticated Users

Allow: Create All Child objects

Creator Owner

Special Permissions

DnsAdmins

Allow: Full Control, Read, Write, Create All Child objects, Delete Child objects, Special Permissions

Domain Admins

Allow: Full Control, Read, Write, Create All Child objects, Delete Child objects

Enterprise Admins

Allow: Full Control, Read, Write, Create All Child objects, Delete Child objects

Enterprise Domain Controllers

Allow: Full Control, Read, Write, Create All Child objects, Delete Child objects, Special Permissions

Everyone

Allow: Read, Special Permissions

Pre-Windows 2000 Compatible Access

Allow: Special Permissions

System

Allow: Full Control, Read, Write, Create All Child objects, Delete Child objects

For more information, see Security Information for DNS.