Check ID: compute_network_dns_logging_enabled
Provider: GCP
Service: compute
Severity: MEDIUM
Categories: logging, forensics-ready
Resource type: compute.googleapis.com/Network

​
What this check verifies

VPC networks are assessed for a DNS policy that enables Cloud DNS query logging. When present, resolvers record queries for the network from VMs, GKE, peering, and inbound forwarding, with entries written to Cloud Logging.

​
Risk

Without DNS query logs, suspicious lookups (C2, DGA, DNS exfiltration) go unseen, reducing confidentiality and hindering incident response. Visibility gaps also hide misconfigurations and elevated NXDOMAIN rates that can impact the availability of name resolution.

​
Recommendation

Enable Cloud DNS query logging for all VPC networks via DNS policies and route logs to centralized analysis. Enforce least privilege on log access, set retention and sampling to manage cost, and add detections for malicious domains. Apply defense in depth with DNS response policies and egress controls.

​
Remediation

resource "google_dns_policy" "<example_resource_name>" {
  name           = "<example_resource_name>"
  enable_logging = true  # CRITICAL: turns on DNS query logging for the policy

  networks {
    network_url = "projects/<PROJECT_ID>/global/networks/<example_resource_name>"  # Attach to the target VPC
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_network_dns_logging_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks