Cloud DNS managed zones should not use RSASHA1 for zone-signing keys
Cloud DNS DNSSEC settings are inspected for the zone-signing key algorithm. Zones that use `rsasha1` for zone signing are identified. Private zones are skipped, and a zone with DNSSEC not enabled is flagged.
Using RSASHA1 for DNSSEC zone signing weakens record integrity due to known collision attacks. Some validating resolvers no longer accept SHA-1, causing resolution failures. Adversaries may forge RRSIGs, enabling DNS hijacking or cache poisoning and redirecting traffic.
What this control checks
Cloud DNS managed zone must not use rsasha1 as the DNSSEC zone-signing key algorithm
Audit evidence
Evidence that deployed resources meet this control: Prowler check dns_rsasha1_in_use_to_zone_sign_in_dnssec (prowler gcp --checks dns_rsasha1_in_use_to_zone_sign_in_dnssec); PowerPipe control gcp_compliance.control.dnssec_prevent_rsasha1_zsk.
Framework-specific interpretation
SOC 2: Mapped to CC6.7 (The entity restricts the transmission, movement, and removal of information to authorized internal and external users...).
NIS2 Directive (EU 2022/2555): Mapped to 12.2.2.c (provide that the transfer shall take place in a secure manner, in accordance with the type of asset to be transferred.), 6.7.2.i (establish communication between distinct systems only through trusted channels that are isolated using logical...), 6.7.2.l (apply best practices for the security of the DNS, and for Internet routing security and routing hygiene of traffic...) and 1 more clause.
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.7 The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity's objectives
- 6 Security in network and information systems acquisition, development and maintenance
- 9 Cryptography
- 12 Asset management
- 3.5 Ensure That RSASHA1 Is Not Used for the Zone-Signing Key in Cloud DNS DNSSEC
- 3.5 Ensure That RSASHA1 Is Not Used for the Zone-Signing Key in Cloud DNS DNSSEC
- OIS-08.02B The following aspects are taken into account when identifying risks, insofar as they are applicable to the cloud service provided and are within the area of responsibility of the cloud service provider: - Processing, storage or transmission of cloud service customer data and cloud...
- 3.5 NOTE: Currently, the SHA1 algorithm has been removed from general use by Google, and, if being used, needs to be whitelisted on a project basis by Google and will also, therefore, require a Google Cloud support contract. DNSSEC algorithm numbers in this registry may be used in CERT RRs. Zone...
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
dnssec_prevent_rsasha1_zsk - Powerpipe Control:
gcp_compliance.control.dnssec_prevent_rsasha1_zsk - Prowler Check:
dns_rsasha1_in_use_to_zone_sign_in_dnssec
Last reviewed: 2026-10-09