[RULE] Check for DNSSEC configuration

[BernieWhite]

Existing rule

No response

Suggested rule

DNSSEC is a set of extensions that use public/ private key pairs to DNS sign responses. This improves security for any client that must resolve records by providing assurance that:

• Records have been sent unaltered.
• The record originated from a server that owned the zone (has access to the private keys). This is secured by the parent zone who also implements DNSSEC to sign the delegation record.

Rule should check that a DNSSEC sub-resource exists in the parent public DNS zone.

Sub resource is: Microsoft.Network/dnsZones/dnssecConfigs the sub-resource name will be default.

Pillar

Security

Additional context

This is a preview feature.

• https://learn.microsoft.com/en-us/azure/dns/dnssec
• https://learn.microsoft.com/en-us/azure/well-architected/security/harden-resources
• https://www.icann.org/resources/pages/dnssec-what-is-it-why-important-2019-03-05-en