Back to Checks
gcp

Cloud DNS managed zone DNSSEC key-signing key does not use RSASHA1

dns_rsasha1_in_use_to_key_sign_in_dnssec
Service: dnsSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:dns.googleapis.com/ManagedZone

Cloud DNS zones are assessed for DNSSEC Key-Signing Key (KSK) algorithms, specifically detecting use of rsasha1. Zones with KSKs on modern algorithms are distinguished from those still using rsasha1.

Prowler logoProwlerprowler-provider-gcp

Risk

Using rsasha1 for KSK weakens DNSSEC. Collision-based forgeries can enable signed record spoofing, resulting in domain hijack, cache poisoning, and redirection-compromising integrity and confidentiality. Some validators reject SHA-1, causing resolution errors and reduced availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks dns_rsasha1_in_use_to_key_sign_in_dnssec

Recommendation

Adopt strong, supported DNSSEC algorithms for KSKs (e.g., ECDSAP256SHA256 or RSASHA256) and retire rsasha1. Rotate keys and validate changes before deployment. Keep KSK and ZSK algorithms consistent, document key-rotation policy, and enforce least privilege for DNS/DNSSEC administration.

Remediation

CLI

gcloud dns managed-zones update <example_resource_name> --dnssec-state on --ksk-algorithm RSASHA256 --ksk-key-length 2048 --zsk-algorithm RSASHA256 --zsk-key-length 1024

Terraform

resource "google_dns_managed_zone" "<example_resource_name>" {
  name     = "<example_resource_name>"
  dns_name = "example.com."

  dnssec_config {
    state = "on"

    default_key_specs {
      key_type   = "keySigning"
      algorithm  = "rsasha256" # FIX: use a non-RSASHA1 KSK algorithm to pass the check
      key_length = 2048
    }

    default_key_specs {
      key_type   = "zoneSigning"
      algorithm  = "rsasha256"
      key_length = 1024
    }
  }
}

Other

1In Google Cloud Console, go to Networking > Cloud DNS and open the affected managed zone
2Click Edit
3If DNSSEC is enabled, set DNSSEC to Off and Save; then click Edit again
4Set DNSSEC to On, expand Advanced options
5Set Key-signing key (KSK) algorithm to RSASHA256 (not RSASHA1); set Zone-signing key (ZSK) algorithm to RSASHA256
6Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.dns.dns_client import dns_client


class dns_rsasha1_in_use_to_key_sign_in_dnssec(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for managed_zone in dns_client.managed_zones:
            report = Check_Report_GCP(
                metadata=self.metadata(),
                resource=managed_zone,
                location=dns_client.region,
            )
            report.status = "PASS"
            report.status_extended = f"Cloud DNS {managed_zone.name} is not using RSASHA1 algorithm as key signing."
            if any(
                [
                    key["algorithm"] == "rsasha1"
                    for key in managed_zone.key_specs
                    if key["keyType"] == "keySigning"
                ]
            ):
                report.status = "FAIL"
                report.status_extended = f"Cloud DNS {managed_zone.name} is using RSASHA1 algorithm as key signing."
            findings.append(report)

        return findings

References