dns: implement dns:modify permission