Back to Checks
gcp

Cloud DNS managed zone has DNSSEC enabled

dns_dnssec_disabled
Service: dnsSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:dns.googleapis.com/ManagedZone

Cloud DNS managed zones are assessed for DNSSEC status. Zones with DNSSEC sign zone data and publish DNSKEY/RRSIG; zones without it remain unsigned and unauthenticated.

Prowler logoProwlerprowler-provider-gcp

Risk

Without DNSSEC, DNS responses lack authenticity, enabling cache poisoning, spoofed referrals, and domain hijacking. Victims may be redirected to attacker hosts, exposing credentials and data (confidentiality), enabling tampered content and records (integrity), and causing misrouting or outages (availability).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks dns_dnssec_disabled

Recommendation

Enable DNSSEC on public zones and complete the chain of trust by publishing a DS record at your registrar. Use DNSSEC-validating resolvers, apply least privilege for DNS administration, and monitor key lifecycle events. Private zones are not DNSSEC-signed.

Remediation

CLI

gcloud dns managed-zones update <DNS_ZONE> --dnssec-state on

Terraform

resource "google_dns_managed_zone" "<example_resource_name>" {
  name     = "<example_resource_name>"
  dns_name = "example.com."

  dnssec_config {
    state = "on" # Critical: enables DNSSEC for the managed zone
  }
}

Other

1In the Google Cloud Console, go to Cloud DNS
2Click the managed zone name
3Click Edit
4Under DNSSEC, select On
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.dns.dns_client import dns_client


class dns_dnssec_disabled(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for managed_zone in dns_client.managed_zones:
            report = Check_Report_GCP(
                metadata=self.metadata(),
                resource=managed_zone,
                location=dns_client.region,
            )
            report.status = "PASS"
            report.status_extended = (
                f"Cloud DNS {managed_zone.name} has DNSSEC enabled."
            )
            if not managed_zone.dnssec:
                report.status = "FAIL"
                report.status_extended = (
                    f"Cloud DNS {managed_zone.name} doesn't have DNSSEC enabled."
                )
            findings.append(report)

        return findings

References