GCP for DevOps — Cloud DNS

2 minute read

Cloud DNS

Cloud DNS is a scalable, reliable DNS service that publishes domain names to the global DNS. It supports public zones (internet-facing) and private zones (VPC-internal), DNSSEC, and DNS forwarding.

Public Zones

# Create a public DNS zone
$ gcloud dns managed-zones create my-zone \
    --dns-name="example.com." \
    --description="Production DNS zone" \
    --visibility=public

# List zones
$ gcloud dns managed-zones list

# Output:
# NAME      DNS_NAME       VISIBILITY
# my-zone   example.com.   public

DNS Records

# Add an A record
$ gcloud dns record-sets create www.example.com. \
    --zone=my-zone \
    --type=A \
    --ttl=300 \
    --rrdatas="35.201.100.50"

# Add a CNAME record
$ gcloud dns record-sets create app.example.com. \
    --zone=my-zone \
    --type=CNAME \
    --ttl=300 \
    --rrdatas="my-app-abc123.a.run.app."

# Add an MX record
$ gcloud dns record-sets create example.com. \
    --zone=my-zone \
    --type=MX \
    --ttl=3600 \
    --rrdatas="10 mail.example.com."

# Add a TXT record (SPF)
$ gcloud dns record-sets create example.com. \
    --zone=my-zone \
    --type=TXT \
    --ttl=300 \
    --rrdatas='"v=spf1 include:_spf.google.com ~all"'

# List records
$ gcloud dns record-sets list --zone=my-zone

# Update a record
$ gcloud dns record-sets update www.example.com. \
    --zone=my-zone \
    --type=A \
    --ttl=600 \
    --rrdatas="35.201.100.51"

# Delete a record
$ gcloud dns record-sets delete www.example.com. \
    --zone=my-zone \
    --type=A

Private Zones

Private DNS zones are only visible within specified VPCs:

# Create a private DNS zone
$ gcloud dns managed-zones create internal-zone \
    --dns-name="internal.example.com." \
    --description="Internal DNS" \
    --visibility=private \
    --networks=my-vpc

# Add internal records
$ gcloud dns record-sets create db.internal.example.com. \
    --zone=internal-zone \
    --type=A \
    --ttl=60 \
    --rrdatas="10.0.1.100"

$ gcloud dns record-sets create cache.internal.example.com. \
    --zone=internal-zone \
    --type=A \
    --ttl=60 \
    --rrdatas="10.0.1.200"

DNSSEC

# Enable DNSSEC on a zone
$ gcloud dns managed-zones update my-zone --dnssec-state=on

# Get DS records (to configure at registrar)
$ gcloud dns dns-keys list --zone=my-zone --filter="type=keySigning"

DNS Forwarding

Forward DNS queries to on-premises resolvers:

# Create a forwarding zone
$ gcloud dns managed-zones create onprem-zone \
    --dns-name="corp.internal." \
    --description="Forward to on-prem DNS" \
    --visibility=private \
    --networks=my-vpc \
    --forwarding-targets="10.100.0.53,10.100.0.54"

DNS Peering

Share DNS zones between VPC networks:

# Create a peering zone
$ gcloud dns managed-zones create peer-zone \
    --dns-name="shared.example.com." \
    --description="DNS peering to shared-vpc" \
    --visibility=private \
    --networks=my-vpc \
    --target-network=shared-vpc \
    --target-project=shared-project

Common Mistakes

Mistake Why It’s Wrong Fix
Missing trailing dot DNS names require trailing dot Always add . to DNS names
TTL too high for dynamic Slow DNS propagation Use 60–300s for dynamic records
No DNSSEC Vulnerable to DNS spoofing Enable DNSSEC on public zones
Wrong VPC for private zone Records not resolvable Verify network bindings
Not using private zones Internal DNS over public Use private zones for internal services

Quick Reference

Command Description
gcloud dns managed-zones create Create DNS zone
gcloud dns record-sets create Add DNS record
gcloud dns record-sets update Update record
gcloud dns record-sets delete Delete record
gcloud dns record-sets list List records

Next → Cloud CDN

Updated:

You may also enjoy