Securing DNS Resource Records

Applies To: Windows Server 2008

The following Domain Name System (DNS) resource record configuration options have security implications for resource records that are stored in both standard DNS zones and Active Directory–integrated DNS zones:

Manage the DACL on DNS resource records that are stored in Active Directory Domain Services

You can use the discretionary access control list (DACL) to control the permissions for the Active Directory users and groups that may control the DNS resource records. For more information, see Modify Security for a Resource Record.

The following table lists the default group or user names and permissions for DNS resource records that are stored in Active Directory Domain Services (AD DS).

Group or user names	Permissions
Administrators	Allow: Read, Write, Create All Child objects, Special Permissions
Authenticated Users	Allow: Create All Child objects
Creator Owner	Special Permissions
DnsAdmins	Allow: Full Control, Read, Write, Create All Child objects, Delete Child objects, Special Permissions
Domain Admins	Allow: Full Control, Read, Write, Create All Child objects, Delete Child objects
Enterprise Admins	Allow: Full Control, Read, Write, Create All Child objects, Delete Child objects
Enterprise Domain Controllers	Allow: Full Control, Read, Write, Create All Child objects, Delete Child objects, Special Permissions
Everyone	Allow: Read, Special Permissions
Pre-Windows 2000 Compatible Access	Allow: Special Permissions
System	Allow: Full Control, Read, Write, Create All Child objects, Delete Child objects

For more information, see Security Information for DNS.