Configure DNS server policies

This page describes how to configure DNS server policies and use them with Virtual Private Cloud (VPC) networks. Before you use this page, review the DNS server policies overview.

Before you begin

The Cloud DNS API requires that you create a Google Cloud project and enable the Cloud DNS API.

If you are creating an application that uses the REST API, you must also create an OAuth 2.0 client ID.

  1. If you don't already have one, sign up for a Google Account.
  2. Enable the Cloud DNS API in the Google Cloud console. You can choose an existing Compute Engine or App Engine project, or you can create a new project.
  3. If you need to make requests to the REST API, you need to create an OAuth 2.0 ID. See Setting up OAuth 2.0.
  4. In the project, note the following information that you need to input in later steps:
    • The client ID (xxxxxx.apps.googleusercontent.com).
    • The project ID that you want to use. You can find the ID at the top of the Overview page in the Google Cloud console. You can also ask your user to provide the project name that they want to use in your app.

If you have not run the Google Cloud CLI previously, you must run the following command to specify the project name and authenticate with the Google Cloud console:

gcloud auth login

To choose a different project than one you have chosen previously, specify the --project option at the command line.

Create DNS server policies

Each DNS server policy object can define any of the following server policies:

Each VPC network can reference no more than one DNS server policy. If you need to define both inbound and outbound forwarding for a VPC network, create one policy that defines both an inbound and an outbound policy. You can't configure DNS64 with an inbound DNS server policy.

Create an inbound DNS server policy

To create an inbound DNS server policy, follow these instructions. Cloud DNS creates a set of inbound forwarder IP addresses from the primary IPv4 address ranges of subnets in each VPC network to which the policy applies. After you create your policy, you can list the entry points that Cloud DNS creates.

Console

  1. In the Google Cloud console, open the Cloud DNS server policies page.

    Go to Cloud DNS server policies

  2. Click Create policy.

  3. In the Name field, enter the name of the inbound DNS server policy that you want to create, such as inbound-dns-server-policy.

  4. In the Inbound query forwarding section, select On.

  5. You can optionally enable DNS64 to enable communication between IPv6-only workloads and IPv4-only destinations. See Configure DNS64 for more information.

  6. You can optionally enable private DNS logs in the Logs section, however, this can increase your costs in Cloud Logging.

  7. In the Networks list, select VPC networks that you want to bind to this DNS server policy.

    A network can only be bound to a single policy. If you can't select a network from the list, it's being used by another policy. To see what network is being used by a policy, view the In use by column on the DNS server policies page.

  8. Click Create.

gcloud

To create an inbound DNS server policy, run the dns policies create command:

gcloud dns policies create NAME \
    --description="DESCRIPTION" \
    --networks="VPC_NETWORK_LIST" \
    --enable-inbound-forwarding

Replace the following:

  • NAME: a name for the policy
  • DESCRIPTION: a description for the policy
  • VPC_NETWORK_LIST: a comma-delimited list of VPC networks that the DNS server policy must bind to

Terraform 

resource "google_dns_policy" "default" {
  name                      = "example-inbound-policy"
  enable_inbound_forwarding = true

  networks {
    network_url = google_compute_network.default.id
  }
}

resource "google_compute_network" "default" {
  name                    = "network"
  auto_create_subnetworks = false
}

Create an outbound DNS server policy

To specify a list of alternative name servers for a VPC network, you can create an outbound DNS server policy.

Console

  1. In the Google Cloud console, open the Cloud DNS server policies page.

    Go to Cloud DNS server policies

  2. Click Create policy.

  3. In the Name field, enter the name of the outbound DNS server policy that you want to create, such as outbound-dns-server-policy.

  4. In the Inbound query forwarding section, select Off.

  5. You can optionally enable private DNS logs in the Logs section, however, this can increase your costs in Cloud Logging.

  6. In the Alternative DNS servers (Optional) section, click Add item, and enter the IP address of your outbound DNS servers in the IP Address field.

    • Select the Private forwarding checkbox if you want to force private routing to outbound DNS servers.

  7. In the Networks list, select VPC networks that you want to bind to this DNS server policy.

  8. Click Create.

gcloud

To create an outbound DNS server policy, run the dns policies create command:

gcloud dns policies create NAME \
    --description="DESCRIPTION" \
    --networks="VPC_NETWORK_LIST" \
    --alternative-name-servers="ALTERNATIVE_NAMESERVER_LIST" \
    --private-alternative-name-servers="PRIVATE_ALTERNATIVE_NAMESERVER_LIST"

Replace the following:

  • NAME: a name for the policy
  • DESCRIPTION: a description for the policy