Cloud DNS managed zone has DNSSEC enabled

Check ID: dns_dnssec_disabled
Provider: GCP
Service: dns
Severity: MEDIUM
Categories: encryption
Resource type: dns.googleapis.com/ManagedZone

What this check verifies

Cloud DNS managed zones are assessed for DNSSEC status. Zones with DNSSEC sign zone data and publish DNSKEY/RRSIG; zones without it remain unsigned and unauthenticated.

Risk

Without DNSSEC, DNS responses lack authenticity, enabling cache poisoning, spoofed referrals, and domain hijacking. Victims may be redirected to attacker hosts, exposing credentials and data (confidentiality), enabling tampered content and records (integrity), and causing misrouting or outages (availability).

Recommendation

Enable DNSSEC on public zones and complete the chain of trust by publishing a DS record at your registrar. Use DNSSEC-validating resolvers, apply least privilege for DNS administration, and monitor key lifecycle events. Private zones are not DNSSEC-signed.

Remediation

CLI
Terraform
Dashboard steps

gcloud dns managed-zones update <DNS_ZONE> —dnssec-state on

resource "google_dns_managed_zone" "<example_resource_name>" {
  name     = "<example_resource_name>"
  dns_name = "example.com."

  dnssec_config {
    state = "on" # Critical: enables DNSSEC for the managed zone
  }
}

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = dns_dnssec_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

Dataproc cluster is encrypted with a CMEK DNSSEC key-signing key does not use RSASHA1

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires