Google Cloud Compliance ControlsGoogle Cloud DNS
Cloud DNS managed zones should not use RSASHA1 for key-signing keys
Evaluates Cloud DNS managed zones to confirm that the `RSASHA1` algorithm is not used for key-signing keys (`KSK`). The control targets the DNSSEC key-signing key algorithm setting on each managed zone and reports zones where it is `RSASHA1`.
What this control checks
Cloud DNS managed zones should not use RSASHA1 for key-signing keys
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
- CC6.7 The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity's objectives
- AC-18 Wireless Access
- CM-2 Baseline Configuration
- CM-7 Least Functionality
- CM-9 Configuration Management Plan
- Configuration Settings (CM-6)
NIST Cybersecurity Framework v1.0
- PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality).
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
dnssec_prevent_rsasha1_ksk - Powerpipe Control:
gcp_compliance.control.dnssec_prevent_rsasha1_ksk
Last reviewed: 2026-10-09