Google Cloud Compliance ControlsGoogle Cloud DNS
Cloud DNS managed zones should have DNSSEC enabled
Cloud DNS managed zones are assessed for DNSSEC status. Zones with DNSSEC sign zone data and publish DNSKEY / RRSIG. Zones without it remain unsigned and unauthenticated.
What this control checks
Public Cloud DNS managed zones with off or unset DNSSEC state fail.
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.7 The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity's objectives
- 6 Security in network and information systems acquisition, development and maintenance
- 9 Cryptography
- 12 Asset management
- AC-18 Wireless Access
- CM-2 Baseline Configuration
- CM-7 Least Functionality
- CM-9 Configuration Management Plan
- Configuration Settings (CM-6)
- 3.3 Ensure That DNSSEC Is Enabled for Cloud DNS
- 3.3 Ensure That DNSSEC Is Enabled for Cloud DNS
- 3.3 Ensure that DNSSEC is enabled for Cloud DNS
- 3.3 Ensure that DNSSEC is enabled for Cloud DNS
- 3.3 Ensure that DNSSEC is enabled for Cloud DNS
NIST Cybersecurity Framework v1.0
- PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality).
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
dns_managed_zone_dnssec_enabled - Checkov Check:
CKV_GCP_16 - Powerpipe Control:
gcp_compliance.control.dns_managed_zone_dnssec_enabled - Prowler Check:
dns_dnssec_disabled - Trivy Check:
GCP-0013
Last reviewed: 2026-10-09