Notifications
Clear all
Topic starter
23/06/2026 7:12 pm
TL;DR: Fine-grained DNS access controls let PKI teams update only the records they need, such as TXT records for domain control validation, while reducing the risk of broad DNS changes and manual ticket bottlenecks, according to DigiCert. The governance shift is less about speed versus safety than about matching access scope to operational responsibility.
NHIMG editorial — based on content published by DigiCert: Fine-Grained DNS Access: Fixing Ownership and Control Gaps
By the numbers:
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems , organisations failing to scope AI access properly are 4.5x more likely to experience a security incident.
Questions worth separating out
Q: How should security teams scope DNS permissions for certificate validation workflows?
A: Security teams should scope DNS permissions to the smallest record set required for the workflow, usually TXT records on a specific subdomain.
Q: Why do broad DNS permissions create both security and availability risk?
A: Broad DNS permissions let routine operational tasks affect records that were never part of the original change request.
Q: What do teams get wrong about DNSSEC and access control?
A: Teams sometimes treat DNSSEC as a substitute for permissions management, but the two controls solve different problems.
Practitioner guidance
- Map DNS roles to record-level authority Inventory which teams need TXT, CNAME, MX, or NS permissions, then remove blanket zone-write access where a narrower role will do the job.
- Separate validation workflows from zone administration Build a dedicated path for certificate validation records so PKI teams can publish only the exact TXT entries needed for domain control validation.
- Pair DNS access control with DNSSEC enforcement Sign critical zones, validate resolver behaviour, and monitor the DNSKEY and DS lifecycle so record integrity is protected after changes are made.
What's in the full article
DigiCert's full blog post covers the operational detail this post intentionally leaves for the source:
- Custom role examples for PKI teams managing TXT records only
- Workflow detail for DNS API automation in certificate validation
- DNSSEC deployment references and zone signing mechanics
- Audit and change-management considerations for shared DNS ownership
👉 Read DigiCert’s analysis of fine-grained DNS access for PKI workflows →
Fine-grained DNS access: what it means for PKI teams?
Explore further
25/06/2026 3:05 am
Fine-grained DNS access is really an ownership model, not just a permissions model. The article shows that PKI friction often comes from shared control over a critical namespace rather than from the certificate workflow itself. When teams can act only on the records tied to their responsibility, DNS becomes governable instead of contested. The practitioner implication is to align access boundaries with operational ownership, not organisational convenience.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to The 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
A question worth separating out:
Q: Who should own DNS changes when PKI and DNS teams both depend on the same zone?
A: Ownership should sit with the team that manages the authoritative zone, while PKI teams receive narrowly scoped permission for validation tasks only. That model preserves accountability, keeps operational control with DNS administrators, and avoids turning certificate workflows into a shared-write environment.
👉 Read our full editorial: Fine-grained DNS access closes PKI ownership gaps
