Back to Checks
gcp

Cloud DNS managed zone does not use the RSASHA1 algorithm for the DNSSEC zone-signing key

dns_rsasha1_in_use_to_zone_sign_in_dnssec
Service: dnsSeverity: medium
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:dns.googleapis.com/ManagedZone

Cloud DNS DNSSEC settings are inspected for the zone-signing key algorithm. Zones that use rsasha1 for zone signing are identified.

Prowler logoProwlerprowler-provider-gcp

Risk

Using RSASHA1 for DNSSEC zone signing weakens record integrity due to known collision attacks. Some validating resolvers no longer accept SHA-1, causing resolution failures. Adversaries may forge RRSIGs, enabling DNS hijacking or cache poisoning and redirecting traffic.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks dns_rsasha1_in_use_to_zone_sign_in_dnssec

Recommendation

Use strong DNSSEC algorithms for zone signing (e.g., rsasha256, ecdsa-p256-sha256, ed25519) and avoid rsasha1. Practice crypto agility: standardize secure defaults, rotate keys, and periodically validate signatures with modern resolvers. Apply defense in depth by monitoring DNSSEC health and limiting who can change settings.

Remediation

Terraform

resource "google_dns_managed_zone" "<example_resource_name>" {
  name     = "<example_resource_name>"
  dns_name = "example.com."

  dnssec_config {
    state = "on"

    default_key_specs {
      algorithm = "ecdsap256sha256"  # FIX: use a secure algorithm for zone signing
      key_type  = "zoneSigning"       # Ensures the zone-signing key is not RSASHA1
    }
  }
}

Other

1In Google Cloud Console, go to Networking > Network services > Cloud DNS
2Click the managed zone name, then click Edit
3If DNSSEC is On and the Zone signing algorithm is RSASHA1: set DNSSEC to Off and Save
4Click Edit again, set DNSSEC to On
5Open Advanced settings, set Zone signing algorithm to ECDSAP256SHA256 (or RSASHA256)
6Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.dns.dns_client import dns_client


class dns_rsasha1_in_use_to_zone_sign_in_dnssec(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for managed_zone in dns_client.managed_zones:
            report = Check_Report_GCP(
                metadata=self.metadata(),
                resource=managed_zone,
                location=dns_client.region,
            )
            report.status = "PASS"
            report.status_extended = f"Cloud DNS {managed_zone.name} is not using RSASHA1 algorithm as zone signing."
            if any(
                [
                    key["algorithm"] == "rsasha1"
                    for key in managed_zone.key_specs
                    if key["keyType"] == "zoneSigning"
                ]
            ):
                report.status = "FAIL"
                report.status_extended = f"Cloud DNS {managed_zone.name} is using RSASHA1 algorithm as zone signing."
            findings.append(report)

        return findings

References