DNSSEC key-signing key does not use RSASHA1

Check ID: dns_rsasha1_in_use_to_key_sign_in_dnssec
Provider: GCP
Service: dns
Severity: MEDIUM
Categories: encryption
Resource type: dns.googleapis.com/ManagedZone

What this check verifies

Cloud DNS zones are assessed for DNSSEC Key-Signing Key (KSK) algorithms, specifically detecting use of rsasha1. Zones with KSKs on modern algorithms are distinguished from those still using rsasha1.

Risk

Using rsasha1 for KSK weakens DNSSEC. Collision-based forgeries can enable signed record spoofing, resulting in domain hijack, cache poisoning, and redirection-compromising integrity and confidentiality. Some validators reject SHA-1, causing resolution errors and reduced availability.

Recommendation

Adopt strong, supported DNSSEC algorithms for KSKs (e.g., ECDSAP256SHA256 or RSASHA256) and retire rsasha1. Rotate keys and validate changes before deployment. Keep KSK and ZSK algorithms consistent, document key-rotation policy, and enforce least privilege for DNS/DNSSEC administration.

Remediation

CLI
Terraform
Dashboard steps

gcloud dns managed-zones update <example_resource_name> —dnssec-state on —ksk-algorithm RSASHA256 —ksk-key-length 2048 —zsk-algorithm RSASHA256 —zsk-key-length 1024

resource "google_dns_managed_zone" "<example_resource_name>" {
  name     = "<example_resource_name>"
  dns_name = "example.com."

  dnssec_config {
    state = "on"

    default_key_specs {
      key_type   = "keySigning"
      algorithm  = "rsasha256" # FIX: use a non-RSASHA1 KSK algorithm to pass the check
      key_length = 2048
    }

    default_key_specs {
      key_type   = "zoneSigning"
      algorithm  = "rsasha256"
      key_length = 1024
    }
  }
}

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = dns_rsasha1_in_use_to_key_sign_in_dnssec. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

Cloud DNS managed zone has DNSSEC enabled DNSSEC zone-signing key does not use RSASHA1

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires