s4-provision: Set security descriptor for DNS records