Cloud DNS: Public, Private and Forwarding Zones

GCP Basics · VPC Networking – Subnets, Firewall, Cloud NAT, Shared VPC and Cloud DNS · Lesson 6 of 6

Cloud DNS hosts public zones for the Internet and private zones visible only to chosen VPCs; forwarding zones and DNS server policies connect it to on-premises DNS.

Cloud DNS is a managed, authoritative DNS service with a 100% availability SLA. Each zone is a managed zone that holds record sets.

flowchart LR
  R["Registrar example.com"] -- "NS records" --> PZ["Public zone example.com<br/>ns-cloud-a1..a4"]
  PZ --> W["www A 34.120.10.5"]
  V["VPC vpc-shop"] --> PRZ["Private zone corp.internal"]
  PRZ --> DB["db A 10.10.2.5"]
  V --> FZ["Forwarding zone onprem.example.com"]
  FZ --> ON["On-premises DNS 192.168.10.53"]
  %% step R: At the registrar, the domain’s NS records point to the four Cloud DNS name servers of the zone.
  %% step PZ: The public zone answers Internet queries for example.com.
  %% step W: A record set such as www A points the name at the load balancer IP.
  %% step PRZ: A private zone is visible only to the VPCs you authorise, here vpc-shop.
  %% step DB: VMs in vpc-shop resolve db.corp.internal to the database’s internal IP.
  %% step FZ: A forwarding zone sends queries for onprem.example.com to on-premises DNS servers over VPN or Interconnect.

Zone types

Type	Visible to	Use
Public	The Internet	Your domain’s public records
Private	Selected VPC networks	Internal names (`corp.internal`, `db.prod.internal`)
Forwarding	Selected VPCs	Send queries for a domain to other DNS servers (on-premises)
Peering	Selected VPCs	Use another VPC’s DNS view (often with Shared VPC or PSC)

DNS server policies add an inbound forwarder (on-premises servers can query your private zones) or an alternative name server for all queries from a VPC.

Records and resolution order

Common record types: A, AAAA, CNAME, MX, TXT, SRV, CAA, NS, SOA. Every zone starts with SOA and NS records. Names in gcloud end with a dot: www.example.com..

Inside a VPC the metadata server 169.254.169.254 resolves names in this order: DNS server policy alternative servers → private zones (including forwarding/peering) → Compute Engine internal DNS → public DNS.

Security and operations

Turn on DNSSEC for public zones to protect against spoofing (and add the DS record at the registrar).
Use low TTLs (60–300 s) before a migration, then raise them.
Cloud Domains can register domains directly in Google Cloud.
Query logging can be enabled per VPC through a DNS policy.

gcloud dns managed-zones create corp-internal --dns-name=corp.internal.   --visibility=private --networks=vpc-shop --description="Internal names"
gcloud dns record-sets create db.corp.internal. --zone=corp-internal   --type=A --ttl=300 --rrdatas=10.10.2.5

Command	Meaning
`gcloud dns managed-zones list`	Zones in the project
`gcloud dns record-sets list --zone=corp-internal`	Records in a zone
`gcloud dns managed-zones describe example-com --format="value(nameServers)"`	Name servers to give the registrar

Traps: forgetting the trailing dot in record names; a private zone does nothing for a VPC that is not in its network list; changing NS at the registrar is needed before a public zone answers for your domain.