Google Cloud Compliance ControlsGoogle Cloud DNS
Cloud DNS managed zones should not use RSASHA1 for zone-signing keys
Cloud DNS DNSSEC settings are inspected for the zone-signing key algorithm. Zones that use `rsasha1` for zone signing are identified. Private zones are skipped, and a zone with DNSSEC not enabled is flagged.
What this control checks
Cloud DNS managed zone must not use rsasha1 as the DNSSEC zone-signing key algorithm
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.7 The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity's objectives
- 6 Security in network and information systems acquisition, development and maintenance
- 9 Cryptography
- 12 Asset management
- 3.5 Ensure That RSASHA1 Is Not Used for the Zone-Signing Key in Cloud DNS DNSSEC
- 3.5 Ensure That RSASHA1 Is Not Used for the Zone-Signing Key in Cloud DNS DNSSEC
- OIS-08.02B The following aspects are taken into account when identifying risks, insofar as they are applicable to the cloud service provided and are within the area of responsibility of the cloud service provider: - Processing, storage or transmission of cloud service customer data and cloud...
- 3.5 NOTE: Currently, the SHA1 algorithm has been removed from general use by Google, and, if being used, needs to be whitelisted on a project basis by Google and will also, therefore, require a Google Cloud support contract. DNSSEC algorithm numbers in this registry may be used in CERT RRs. Zone...
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
dnssec_prevent_rsasha1_zsk - Powerpipe Control:
gcp_compliance.control.dnssec_prevent_rsasha1_zsk - Prowler Check:
dns_rsasha1_in_use_to_zone_sign_in_dnssec
Last reviewed: 2026-10-09