dns: fix templates to use new permissions