Role accounts may have dnsZoneEntry attributes