Cloud DNS overview

This page provides an overview of Cloud DNS features and capabilities. Cloud DNS is a high-performance, resilient, global Domain Name System (DNS) service that publishes your domain names to the global DNS in a cost-effective way.

DNS is a hierarchical distributed database that lets you store IP addresses and other data and look them up by name. Cloud DNS lets you publish your zones and records in DNS without the burden of managing your own DNS servers and software.

Cloud DNS offers both public zones and private managed DNS zones. A public zone is visible to the public internet, while a private zone is visible only from one or more Virtual Private Cloud (VPC) networks that you specify. For detailed information about zones, see DNS zones overview.

Cloud DNS supports Identity and Access Management (IAM) permissions at the project level and individual DNS zone level. For information about how to set individual resource IAM permissions, see Create a zone with specific IAM permissions.

For a list of general DNS terminology, see the General DNS overview.

For a list of key terminology on which Cloud DNS is built, see Key terms.

To get started using Cloud DNS, see the Quickstart.

Try it for yourself

If you're new to Google Cloud, create an account to evaluate how Cloud DNS performs in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

Try Cloud DNS free

Shared VPC considerations

To use a Cloud DNS managed private zone, Cloud DNS forwarding zone, or Cloud DNS peering zone with Shared VPC, you must create the zone in the host project, and then add one or more Shared VPC networks to the list of authorized networks for that zone. Alternatively, you can set up the zone in a service project using cross-project binding.

For more information, see Best practices for Cloud DNS private zones.

DNS forwarding methods

Google Cloud offers inbound and outbound DNS forwarding for private zones. You can configure DNS forwarding by creating a forwarding zone or a Cloud DNS server policy. The two methods are summarized in the following table.

DNS forwarding	Cloud DNS methods
Inbound	Create an inbound server policy to enable an on-premises DNS client or server to send DNS requests to Cloud DNS. The DNS client or server can then resolve records according to a VPC network's name resolution order. On-premises clients can resolve records in private zones, forwarding zones, and peering zones for which the VPC network has been authorized. On-premises clients use Cloud VPN or Cloud Interconnect to connect to the VPC network.
Outbound	You can configure VMs in a VPC network to do the following: Send DNS requests to DNS name servers of your choosing. The name servers can be located in the same VPC network, in an on-premises network, or on the internet. Resolve records hosted on name servers configured as forwarding targets of a forwarding zone authorized for use by your VPC network. For information about how Google Cloud routes traffic to a forwarding target, see Forwarding targets and routing methods. Create an outbound server policy for the VPC network to send all DNS requests to an alternative name server. When using an alternative name server, VMs in your VPC network are no longer able to resolve records in Cloud DNS private zones, forwarding zones, peering zones, or Compute Engine internal DNS zones. For additional details, see Name resolution order.

DNS forwarding

Cloud DNS methods

Inbound

Create an inbound server policy to enable an on-premises DNS client or server to send DNS requests to Cloud DNS. The DNS client or server can then resolve records according to a VPC network's name resolution order.

On-premises clients can resolve records in private zones, forwarding zones, and peering zones for which the VPC network has been authorized. On-premises clients use Cloud VPN or Cloud Interconnect to connect to the VPC network.

Outbound

You can configure VMs in a VPC network to do the following:

Send DNS requests to DNS name servers of your choosing. The name servers can be located in the same VPC network, in an on-premises network, or on the internet.
Resolve records hosted on name servers configured as forwarding targets of a forwarding zone authorized for use by your VPC network. For information about how Google Cloud routes traffic to a forwarding target, see Forwarding targets and routing methods.
Create an outbound server policy for the VPC network to send all DNS requests to an alternative name server. When using an alternative name server, VMs in your VPC network are no longer able to resolve records in Cloud DNS private zones, forwarding zones, peering zones, or Compute Engine internal DNS zones. For additional details, see Name resolution order.

You can simultaneously configure inbound and outbound DNS forwarding for a VPC network. Bi-directional forwarding lets VMs in your VPC network resolve records in an on-premises network or in a network hosted by a different cloud provider. This type of forwarding also enables hosts in the on-premises network to resolve records for your Google Cloud resources.

The Cloud DNS control plane uses the forwarding target selection order to select a forwarding target. Outbound forwarded queries might sometimes result in SERVFAIL errors if the forwarding targets are not reachable or if they don't respond quickly enough. For troubleshooting instructions, see Outbound forwarded queries receive SERVFAIL errors.

For information about how to apply server policies, see Create DNS server policies. To learn how to create a forwarding zone, see Create a forwarding zone.

DNSSEC

Cloud DNS supports managed Domain Name System Security Extensions (DNSSEC), protecting your domains from spoofing and cache poisoning attacks. When you use a validating resolver like Google Public DNS, DNSSEC provides strong authentication (but not encryption) of domain lookups. For more information about DNSSEC, see Managing DNSSEC configuration.

Advanced threat detection

Monitor your internet-bound DNS queries for malicious activity using DNS Armor, powered by Infoblox. Your internet-bound DNS query logs are analyzed by Infoblox for malicious patterns and other signs of compromise, providing visibility into threats without impacting your production traffic. For more information about DNS Armor threat detection, see Advanced threat detection overview.

DNS64

You can connect your IPv6-only Compute Engine virtual machine (VM) instances to IPv4 destinations by using Cloud DNS DNS64. DNS64 provides a synthesized IPv6 address for each IPv4 destination. Cloud DNS creates a synthesized address by combining the Well-Known Prefix (WKP) 64:ff9b::/96 with the 32 bits of the destination IPv4 address.

Set up DNS64 and network address translation with Public NAT (NAT64) to enable your IPv6-only VM instances to communicate with IPv4 destinations on the internet. To configure NAT64, follow the instructions in Create a Cloud NAT gateway.

The following example shows how an IPv6-only VM instance named vmipv6 resolves the name of an IPv4-only destination.

The vmipv6 VM instance initiates a DNS request to resolve the destination name to an IPv6 address.
If a AAAA record (IPv6 address) exists, Cloud DNS returns the IPv6 address, and the vmipv6 VM instance uses it to connect to the destination.
If no AAAA record exists, but you configured DNS64, Cloud DNS searches for an A record (IPv4 address). If Cloud DNS finds an A record, it synthesizes a AAAA record by prefixing the IPv4 address with 64:ff9b::/96.

DNS64 translates an IPv4 address to a synthesized IPv6 address. — DNS64 translates an IPv4 address to a synthesized IPv6 address (click to enlarge).

For example, if the IPv4 address is 32.34.50.60, the resulting synthesized IPv6 address is 64:ff9b::2022:323c, where 2022:323c is the hexadecimal equivalent of the IPv4 address. The 64:ff9b::/96 prefix is defined in RFC 6052. Cloud DNS synthesizes these IPv6 addresses even when you host the DNS records on-premises, as long as you enable DNS forwarding in Cloud DNS.

You can use DNS64 in the following scenarios:

Adhere to mandates requiring a shift to IPv6 addresses without allocating IPv4 addresses.