Check ID: dns_rsasha1_in_use_to_zone_sign_in_dnssec
Provider: GCP
Service: dns
Severity: MEDIUM
Categories: vulnerabilities
Resource type: dns.googleapis.com/ManagedZone

​
What this check verifies

Cloud DNS DNSSEC settings are inspected for the zone-signing key algorithm. Zones that use rsasha1 for zone signing are identified.

​
Risk

Using RSASHA1 for DNSSEC zone signing weakens record integrity due to known collision attacks. Some validating resolvers no longer accept SHA-1, causing resolution failures. Adversaries may forge RRSIGs, enabling DNS hijacking or cache poisoning and redirecting traffic.

​
Recommendation

Use strong DNSSEC algorithms for zone signing (e.g., rsasha256, ecdsa-p256-sha256, ed25519) and avoid rsasha1. Practice crypto agility: standardize secure defaults, rotate keys, and periodically validate signatures with modern resolvers. Apply defense in depth by monitoring DNSSEC health and limiting who can change settings.

​
Remediation

resource "google_dns_managed_zone" "<example_resource_name>" {
  name     = "<example_resource_name>"
  dns_name = "example.com."

  dnssec_config {
    state = "on"

    default_key_specs {
      algorithm = "ecdsap256sha256"  # FIX: use a secure algorithm for zone signing
      key_type  = "zoneSigning"       # Ensures the zone-signing key is not RSASHA1
    }
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = dns_rsasha1_in_use_to_zone_sign_in_dnssec. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks