Cloud DNS managed zones should have DNSSEC enabled
Cloud DNS managed zones are assessed for DNSSEC status. Zones with DNSSEC sign zone data and publish DNSKEY / RRSIG. Zones without it remain unsigned and unauthenticated.
Without DNSSEC, DNS responses lack authenticity, enabling cache poisoning, spoofed referrals, and domain hijacking. Victims may be redirected to attacker hosts, exposing credentials and data (confidentiality), enabling tampered content and records (integrity), and causing misrouting or outages (availability).
What this control checks
Public Cloud DNS managed zones with off or unset DNSSEC state fail.
Common pitfalls
Private zones are not DNSSEC-signed
Private zones are not DNSSEC-signed.
Private visibility makes the check irrelevant
Checkov returns UNKNOWN when visibility is private. The check is irrelevant (cannot set DNSSEC to anything else).
Audit evidence
Evidence that deployed resources meet this control: Prowler check dns_dnssec_disabled (prowler gcp --checks dns_dnssec_disabled); PowerPipe control gcp_compliance.control.dns_managed_zone_dnssec_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_16; Trivy check GCP-0013.
Framework-specific interpretation
SOC 2: Mapped to CC6.7 (The entity restricts the transmission, movement, and removal of information to authorized internal and external users...).
NIS2 Directive (EU 2022/2555): Mapped to 12.2.2.c (provide that the transfer shall take place in a secure manner, in accordance with the type of asset to be transferred.), 6.7.2.i (establish communication between distinct systems only through trusted channels that are isolated using logical...), 6.7.2.l (apply best practices for the security of the DNS, and for Internet routing security and routing hygiene of traffic...) and 1 more clause.
NIST SP 800-53 Rev 5: Mapped to AC-18 (Wireless Access), CM-2 (Baseline Configuration), CM-6 (Configuration Settings) and 2 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.7 The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity's objectives
- 6 Security in network and information systems acquisition, development and maintenance
- 9 Cryptography
- 12 Asset management
- AC-18 Wireless Access
- CM-2 Baseline Configuration
- CM-7 Least Functionality
- CM-9 Configuration Management Plan
- Configuration Settings (CM-6)
- 3.3 Ensure That DNSSEC Is Enabled for Cloud DNS
- 3.3 Ensure That DNSSEC Is Enabled for Cloud DNS
- 3.3 Ensure that DNSSEC is enabled for Cloud DNS
- 3.3 Ensure that DNSSEC is enabled for Cloud DNS
- 3.3 Ensure that DNSSEC is enabled for Cloud DNS
NIST Cybersecurity Framework v1.0
- PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality).
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
dns_managed_zone_dnssec_enabled - Checkov Check:
CKV_GCP_16 - Powerpipe Control:
gcp_compliance.control.dns_managed_zone_dnssec_enabled - Prowler Check:
dns_dnssec_disabled - Trivy Check:
GCP-0013
Last reviewed: 2026-10-09