Cloud DNS Configuration

# Create the zone with DNSSEC enabled from the start
gcloud dns managed-zones create example-zone \
  --dns-name="example.com." \
  --description="Production DNS zone" \
  --visibility=public \
  --dnssec-state=on

# View the assigned name servers (update these at your registrar)
gcloud dns managed-zones describe example-zone \
  --format="value(nameServers)"

# Add an A record for the apex domain
gcloud dns record-sets create example.com. \
  --zone=example-zone \
  --type=A \
  --ttl=300 \
  --rrdatas="34.120.1.100"

# Add a CNAME for www
gcloud dns record-sets create www.example.com. \
  --zone=example-zone \
  --type=CNAME \
  --ttl=300 \
  --rrdatas="example.com."

# Add MX records for email (Google Workspace example)
gcloud dns record-sets create example.com. \
  --zone=example-zone \
  --type=MX \
  --ttl=3600 \
  --rrdatas="1 aspmx.l.google.com.,5 alt1.aspmx.l.google.com.,5 alt2.aspmx.l.google.com.,10 alt3.aspmx.l.google.com.,10 alt4.aspmx.l.google.com."

# Add SPF record for email authentication
gcloud dns record-sets create example.com. \
  --zone=example-zone \
  --type=TXT \
  --ttl=3600 \
  --rrdatas='"v=spf1 include:_spf.google.com ~all"'

# Add DMARC record for email reporting
gcloud dns record-sets create _dmarc.example.com. \
  --zone=example-zone \
  --type=TXT \
  --ttl=3600 \
  --rrdatas='"v=DMARC1; p=reject; rua=mailto:dmarc@example.com; pct=100"'

# Add CAA record to restrict certificate authorities
gcloud dns record-sets create example.com. \
  --zone=example-zone \
  --type=CAA \
  --ttl=3600 \
  --rrdatas='0 issue "letsencrypt.org",0 issue "pki.goog",0 iodef "mailto:security@example.com"'

# SPF record - authorize Google Workspace and SendGrid
gcloud dns record-sets create example.com. \
  --zone=example-zone \
  --type=TXT \
  --ttl=3600 \
  --rrdatas='"v=spf1 include:_spf.google.com include:sendgrid.net -all"'

# DKIM record - add the key provided by your email service
# Google Workspace generates this key in Admin Console > Apps > Google Workspace > Gmail > Authenticate Email
gcloud dns record-sets create google._domainkey.example.com. \
  --zone=example-zone \
  --type=TXT \
  --ttl=3600 \
  --rrdatas='"v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GN..."'

# DMARC record - reject unauthorized emails, send reports
gcloud dns record-sets create _dmarc.example.com. \
  --zone=example-zone \
  --type=TXT \
  --ttl=3600 \
  --rrdatas='"v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc-reports@example.com; ruf=mailto:dmarc-forensic@example.com; pct=100; adkim=s; aspf=s"'

# Verify your configuration
# dig +short TXT example.com (check SPF)
# dig +short TXT google._domainkey.example.com (check DKIM)
# dig +short TXT _dmarc.example.com (check DMARC)

# Create a private zone attached to your production VPC
gcloud dns managed-zones create internal-zone \
  --dns-name="internal.example.com." \
  --description="Internal service discovery" \
  --visibility=private \
  --networks=projects/my-project/global/networks/prod-vpc

# Add records for internal services
gcloud dns record-sets create api.internal.example.com. \
  --zone=internal-zone \
  --type=A \
  --ttl=60 \
  --rrdatas="10.10.0.50"

gcloud dns record-sets create db-primary.internal.example.com. \
  --zone=internal-zone \
  --type=A \
  --ttl=60 \
  --rrdatas="10.10.16.10"

gcloud dns record-sets create db-replica.internal.example.com. \
  --zone=internal-zone \
  --type=A \
  --ttl=60 \
  --rrdatas="10.10.16.11,10.10.16.12"

gcloud dns record-sets create cache.internal.example.com. \
  --zone=internal-zone \
  --type=A \
  --ttl=60 \
  --rrdatas="10.10.16.20"

gcloud dns record-sets create worker.internal.example.com. \
  --zone=internal-zone \
  --type=A \
  --ttl=60 \
  --rrdatas="10.10.0.60"

# Authorize additional VPCs to use this zone
gcloud dns managed-zones update internal-zone \
  --networks=projects/my-project/global/networks/prod-vpc,projects/my-project/global/networks/staging-vpc

# Use SRV records for service discovery with port information
gcloud dns record-sets create _grpc._tcp.api.internal.example.com. \
  --zone=internal-zone \
  --type=SRV \
  --ttl=60 \
  --rrdatas="10 0 8443 api.internal.example.com."

# List all records in the zone
gcloud dns record-sets list --zone=internal-zone \
  --format="table(name, type, ttl, rrdatas)"

# In the service project: create a peering zone that forwards
# internal.example.com queries to the host project's VPC
gcloud dns managed-zones create peer-to-host \
  --dns-name="internal.example.com." \
  --description="Peer DNS queries to host project VPC" \
  --visibility=private \
  --networks=projects/service-project/global/networks/service-vpc \
  --peer-project=host-project \
  --peer-network=host-vpc

# Verify the peering is working
gcloud dns managed-zones describe peer-to-host \
  --format="yaml(peeringConfig)"

# Test resolution from a VM in the service project
# gcloud compute ssh my-vm --zone=us-central1-a -- nslookup api.internal.example.com

# Outbound forwarding: resolve on-premises domains from GCP
# Forward queries for corp.internal to on-prem DNS servers
gcloud dns managed-zones create onprem-forward \
  --dns-name="corp.internal." \
  --description="Forward to on-prem DNS" \
  --visibility=private \
  --networks=projects/my-project/global/networks/prod-vpc \
  --forwarding-targets="10.0.0.53,10.0.0.54"

# Use private routing for forwarding targets reachable via VPN/Interconnect
gcloud dns managed-zones create onprem-forward-private \
  --dns-name="legacy.corp.internal." \
  --description="Forward to on-prem DNS via private routing" \
  --visibility=private \
  --networks=projects/my-project/global/networks/prod-vpc \
  --forwarding-targets="10.0.0.53=private,10.0.0.54=private"

# Inbound forwarding: allow on-premises DNS to query Cloud DNS
# Create an inbound DNS policy so on-prem can reach Cloud DNS
gcloud dns policies create allow-inbound \
  --description="Allow inbound DNS from on-prem" \
  --networks=projects/my-project/global/networks/prod-vpc \
  --enable-inbound-forwarding

# View the inbound forwarder IP addresses
# (configure your on-prem DNS to forward GCP zones to these IPs)
gcloud compute addresses list \
  --filter="purpose=DNS_RESOLVER" \
  --format="table(address, region, subnetwork)"

# Set up conditional forwarding on your on-premises DNS server
# For Windows DNS: Add Conditional Forwarder for internal.example.com
# For BIND: Add forward zone for internal.example.com pointing to the inbound IPs
# For Unbound: Add forward-zone for internal.example.com

# Enable DNSSEC on a new zone
gcloud dns managed-zones create secure-zone \
  --dns-name="example.com." \
  --description="DNSSEC-enabled production zone" \
  --visibility=public \
  --dnssec-state=on

# Enable DNSSEC on an existing zone
gcloud dns managed-zones update example-zone \
  --dnssec-state=on

# Wait for all records to be signed (check status)
gcloud dns managed-zones describe example-zone \
  --format="value(dnssecConfig.state)"

# Get the DS record to add at your registrar
gcloud dns dns-keys list \
  --zone=example-zone \
  --filter="type=keySigning" \
  --format="value(ds_record())"

# Get full key details for debugging
gcloud dns dns-keys list \
  --zone=example-zone \
  --format="table(id, type, algorithm, keyTag, isActive)"

# Verify DNSSEC is working (after registrar update)
# dig +dnssec example.com @8.8.8.8
# dig DS example.com @8.8.8.8
# Or use online tools: dnsviz.net or dnssec-analyzer.verisignlabs.com

# Create the response policy
gcloud dns response-policies create security-policy \
  --description="Block known malicious domains" \
  --networks=projects/my-project/global/networks/prod-vpc

# Block a malicious domain (returns NXDOMAIN)
gcloud dns response-policies rules create block-malware-c2 \
  --response-policy=security-policy \
  --dns-name="malware-c2.example.bad." \
  --behavior=behaviorUnspecified

# Block an entire malicious TLD using wildcard
gcloud dns response-policies rules create block-bad-tld \
  --response-policy=security-policy \
  --dns-name="*.malicious-tld." \
  --behavior=behaviorUnspecified

# Redirect a domain to an internal proxy/mirror
gcloud dns response-policies rules create redirect-api \
  --response-policy=security-policy \
  --dns-name="api.thirdparty.com." \
  --local-data='{
    "localDatas": [{
      "name": "api.thirdparty.com.",
      "type": "A",
      "ttl": 60,
      "rrdatas": ["10.10.0.100"]
    }]
  }'

# Create a maintenance page redirect
gcloud dns response-policies rules create maintenance-redirect \
  --response-policy=security-policy \
  --dns-name="app.example.com." \
  --local-data='{
    "localDatas": [{
      "name": "app.example.com.",
      "type": "A",
      "ttl": 30,
      "rrdatas": ["10.10.0.200"]
    }]
  }'

# List all rules in the policy
gcloud dns response-policies rules list \
  --response-policy=security-policy \
  --format="table(ruleName, dnsName, behavior)"

# Delete a rule (e.g., after maintenance is over)
gcloud dns response-policies rules delete maintenance-redirect \
  --response-policy=security-policy

# Enable DNS logging on a VPC network via a DNS policy
gcloud dns policies create dns-logging-policy \
  --description="Enable DNS query logging" \
  --networks=projects/my-project/global/networks/prod-vpc \
  --enable-logging

# View DNS query logs in Cloud Logging
gcloud logging read 'resource.type="dns_query"' \
  --limit=50 \
  --format="table(timestamp, jsonPayload.queryName, jsonPayload.queryType, jsonPayload.responseCode, jsonPayload.sourceIP)"

# Create a log-based metric for DNS query failures
gcloud logging metrics create dns-query-failures \
  --description="Count of DNS queries that returned errors" \
  --log-filter='resource.type="dns_query" AND jsonPayload.responseCode!="NOERROR"'

# Create a log sink to BigQuery for long-term analysis
gcloud logging sinks create dns-to-bigquery \
  bigquery.googleapis.com/projects/my-project/datasets/dns_logs \
  --log-filter='resource.type="dns_query"'

# Set up an alert for unusual DNS query volume (potential exfiltration)
gcloud alpha monitoring policies create \
  --notification-channels=projects/my-project/notificationChannels/12345 \
  --display-name="High DNS Query Volume Alert" \
  --condition-display-name="DNS queries exceeding threshold" \
  --condition-filter='resource.type="dns_query"' \
  --aggregation-alignment-period=300s \
  --aggregation-per-series-aligner=ALIGN_RATE \
  --condition-comparison=COMPARISON_GT \
  --condition-threshold-value=1000

# Parent zone (managed by platform team)
gcloud dns managed-zones create example-zone \
  --dns-name="example.com." \
  --description="Root zone - managed by platform team" \
  --visibility=public \
  --dnssec-state=on

# Child zone for API team (can be in a different project)
# Run this in the API team's project:
gcloud dns managed-zones create api-zone \
  --dns-name="api.example.com." \
  --description="API subdomain - managed by API team" \
  --visibility=public \
  --dnssec-state=on \
  --project=api-team-project

# Get the child zone's name servers
gcloud dns managed-zones describe api-zone \
  --project=api-team-project \
  --format="value(nameServers)"
# Returns: ns-cloud-b1.googledomains.com,...

# In the parent zone: add NS records to delegate
gcloud dns record-sets create api.example.com. \
  --zone=example-zone \
  --type=NS \
  --ttl=3600 \
  --rrdatas="ns-cloud-b1.googledomains.com.,ns-cloud-b2.googledomains.com.,ns-cloud-b3.googledomains.com.,ns-cloud-b4.googledomains.com."

# For DNSSEC: add DS record in parent zone for the child zone
# Get the DS record from the child zone
gcloud dns dns-keys list --zone=api-zone \
  --project=api-team-project \
  --filter="type=keySigning" \
  --format="value(ds_record())"

# Add DS record in parent zone
gcloud dns record-sets create api.example.com. \
  --zone=example-zone \
  --type=DS \
  --ttl=3600 \
  --rrdatas="<DS-record-from-child-zone>"

# Now the API team can manage their own records independently
gcloud dns record-sets create v1.api.example.com. \
  --zone=api-zone \
  --project=api-team-project \
  --type=A \
  --ttl=300 \
  --rrdatas="34.120.2.50"

gcloud dns record-sets create v2.api.example.com. \
  --zone=api-zone \
  --project=api-team-project \
  --type=A \
  --ttl=300 \
  --rrdatas="34.120.2.60"

# Weighted routing for canary deployment
# Send 90% of traffic to stable, 10% to canary
gcloud dns record-sets create app.example.com. \
  --zone=example-zone \
  --type=A \
  --ttl=60 \
  --routing-policy-type=WRR \
  --routing-policy-data="0.9=34.120.1.100;0.1=34.120.1.200"

# Geolocation routing for multi-region
gcloud dns record-sets create app.example.com. \
  --zone=example-zone \
  --type=A \
  --ttl=300 \
  --routing-policy-type=GEO \
  --routing-policy-data="us-east1=34.120.1.100;europe-west1=34.120.2.100;asia-east1=34.120.3.100"

# Failover routing with health checks
# First create a health check
gcloud compute health-checks create http app-health-check \
  --port=80 \
  --request-path=/healthz \
  --check-interval=10 \
  --healthy-threshold=2 \
  --unhealthy-threshold=3

# Then use failover routing
gcloud dns record-sets create app.example.com. \
  --zone=example-zone \
  --type=A \
  --ttl=60 \
  --routing-policy-type=FAILOVER \
  --routing-policy-primary-data="34.120.1.100" \
  --routing-policy-backup-data-type=GEO \
  --routing-policy-backup-data="us-east1=34.120.2.100;europe-west1=34.120.3.100" \
  --health-check=app-health-check

# variables.tf
variable "project_id" {
  description = "GCP project ID"
  type        = string
}

variable "domain" {
  description = "Primary domain name"
  type        = string
  default     = "example.com"
}

variable "internal_services" {
  description = "Map of service names to internal IPs"
  type        = map(string)
  default = {
    "api"    = "10.10.0.50"
    "db"     = "10.10.16.10"
    "cache"  = "10.10.16.20"
    "worker" = "10.10.0.60"
    "queue"  = "10.10.0.70"
  }
}

# Public zone with DNSSEC
resource "google_dns_managed_zone" "public" {
  name        = "public-zone"
  dns_name    = "${var.domain}."
  description = "Production public DNS zone"
  visibility  = "public"

  dnssec_config {
    state = "on"
    default_key_specs {
      algorithm  = "rsasha256"
      key_length = 2048
      key_type   = "keySigning"
    }
    default_key_specs {
      algorithm  = "rsasha256"
      key_length = 1024
      key_type   = "zoneSigning"
    }
  }
}

# Private zone for internal service discovery
resource "google_dns_managed_zone" "internal" {
  name        = "internal-zone"
  dns_name    = "internal.${var.domain}."
  description = "Internal service discovery"
  visibility  = "private"

  private_visibility_config {
    networks {
      network_url = google_compute_network.prod_vpc.id
    }
    networks {
      network_url = google_compute_network.staging_vpc.id
    }
  }
}

# Apex domain A record (load balancer)
resource "google_dns_record_set" "apex" {
  name         = google_dns_managed_zone.public.dns_name
  managed_zone = google_dns_managed_zone.public.name
  type         = "A"
  ttl          = 300
  rrdatas      = [google_compute_global_address.lb_ip.address]
}

# WWW CNAME
resource "google_dns_record_set" "www" {
  name         = "www.${google_dns_managed_zone.public.dns_name}"
  managed_zone = google_dns_managed_zone.public.name
  type         = "CNAME"
  ttl          = 300
  rrdatas      = [google_dns_managed_zone.public.dns_name]
}

# MX records for Google Workspace
resource "google_dns_record_set" "mx" {
  name         = google_dns_managed_zone.public.dns_name
  managed_zone = google_dns_managed_zone.public.name
  type         = "MX"
  ttl          = 3600
  rrdatas = [
    "1 aspmx.l.google.com.",
    "5 alt1.aspmx.l.google.com.",
    "5 alt2.aspmx.l.google.com.",
    "10 alt3.aspmx.l.google.com.",
    "10 alt4.aspmx.l.google.com.",
  ]
}

# Email authentication records
resource "google_dns_record_set" "spf" {
  name         = google_dns_managed_zone.public.dns_name
  managed_zone = google_dns_managed_zone.public.name
  type         = "TXT"
  ttl          = 3600
  rrdatas      = ["v=spf1 include:_spf.google.com -all"]
}

resource "google_dns_record_set" "dmarc" {
  name         = "_dmarc.${google_dns_managed_zone.public.dns_name}"
  managed_zone = google_dns_managed_zone.public.name
  type         = "TXT"
  ttl          = 3600
  rrdatas      = ["v=DMARC1; p=reject; rua=mailto:dmarc@${var.domain}"]
}

# CAA record to restrict certificate issuers
resource "google_dns_record_set" "caa" {
  name         = google_dns_managed_zone.public.dns_name
  managed_zone = google_dns_managed_zone.public.name
  type         = "CAA"
  ttl          = 3600
  rrdatas = [
    "0 issue \"letsencrypt.org\"",
    "0 issue \"pki.goog\"",
    "0 iodef \"mailto:security@${var.domain}\"",
  ]
}

# Dynamically create internal service records
resource "google_dns_record_set" "internal_services" {
  for_each = var.internal_services

  name         = "${each.key}.${google_dns_managed_zone.internal.dns_name}"
  managed_zone = google_dns_managed_zone.internal.name
  type         = "A"
  ttl          = 60
  rrdatas      = [each.value]
}

# DNS forwarding zone for on-premises resolution
resource "google_dns_managed_zone" "onprem_forward" {
  name        = "onprem-forward"
  dns_name    = "corp.internal."
  description = "Forward to on-premises DNS"
  visibility  = "private"

  private_visibility_config {
    networks {
      network_url = google_compute_network.prod_vpc.id
    }
  }

  forwarding_config {
    target_name_servers {
      ipv4_address    = "10.0.0.53"
      forwarding_path = "private"
    }
    target_name_servers {
      ipv4_address    = "10.0.0.54"
      forwarding_path = "private"
    }
  }
}

# DNS logging policy
resource "google_dns_policy" "logging" {
  name                      = "dns-logging"
  enable_logging            = true
  enable_inbound_forwarding = true

  networks {
    network_url = google_compute_network.prod_vpc.id
  }
}

# Response policy for security
resource "google_dns_response_policy" "security" {
  response_policy_name = "security-policy"
  description          = "Block known malicious domains"

  networks {
    network_url = google_compute_network.prod_vpc.id
  }
}

resource "google_dns_response_policy_rule" "block_malware" {
  response_policy = google_dns_response_policy.security.response_policy_name
  rule_name       = "block-malware"
  dns_name        = "known-bad-domain.example."

  local_data {
    local_datas {
      name    = "known-bad-domain.example."
      type    = "A"
      ttl     = 60
      rrdatas = ["0.0.0.0"]
    }
  }
}

# Outputs
output "public_zone_name_servers" {
  value       = google_dns_managed_zone.public.name_servers
  description = "Update your registrar with these name servers"
}

output "internal_zone_dns_name" {
  value       = google_dns_managed_zone.internal.dns_name
  description = "Internal DNS zone name for service discovery"
}

# === Environment-specific public zones ===
# Production: example.com (managed by platform team)
gcloud dns managed-zones create prod-public \
  --dns-name="example.com." \
  --description="Production public zone" \
  --visibility=public \
  --dnssec-state=on \
  --project=dns-hub-project

# Staging: staging.example.com (delegated to staging project)
gcloud dns managed-zones create staging-public \
  --dns-name="staging.example.com." \
  --description="Staging public zone" \
  --visibility=public \
  --project=staging-project

# Dev: dev.example.com (delegated to dev project)
gcloud dns managed-zones create dev-public \
  --dns-name="dev.example.com." \
  --description="Development public zone" \
  --visibility=public \
  --project=dev-project

# === Delegate subdomains from prod zone ===
gcloud dns record-sets create staging.example.com. \
  --zone=prod-public \
  --type=NS \
  --ttl=3600 \
  --rrdatas="ns-cloud-c1.googledomains.com.,ns-cloud-c2.googledomains.com.,ns-cloud-c3.googledomains.com.,ns-cloud-c4.googledomains.com." \
  --project=dns-hub-project

gcloud dns record-sets create dev.example.com. \
  --zone=prod-public \
  --type=NS \
  --ttl=3600 \
  --rrdatas="ns-cloud-d1.googledomains.com.,ns-cloud-d2.googledomains.com.,ns-cloud-d3.googledomains.com.,ns-cloud-d4.googledomains.com." \
  --project=dns-hub-project

# === Environment-specific private zones ===
# Production private zone (centralized in DNS hub project)
gcloud dns managed-zones create prod-internal \
  --dns-name="prod.internal.example.com." \
  --description="Production internal services" \
  --visibility=private \
  --networks=projects/host-project/global/networks/prod-vpc \
  --project=dns-hub-project

# Staging private zone
gcloud dns managed-zones create staging-internal \
  --dns-name="staging.internal.example.com." \
  --description="Staging internal services" \
  --visibility=private \
  --networks=projects/host-project/global/networks/staging-vpc \
  --project=dns-hub-project

# Dev private zone
gcloud dns managed-zones create dev-internal \
  --dns-name="dev.internal.example.com." \
  --description="Dev internal services" \
  --visibility=private \
  --networks=projects/host-project/global/networks/dev-vpc \
  --project=dns-hub-project

# Check if Cloud DNS is returning the expected record
dig +short example.com @ns-cloud-a1.googledomains.com

# Check DNS propagation globally
dig +trace example.com

# Verify DNSSEC chain of trust
dig +dnssec +multi example.com @8.8.8.8

# Check if a private zone record resolves from within a VM
# (Run from a VM in the authorized VPC)
dig api.internal.example.com @169.254.169.254

# Verify zone configuration
gcloud dns managed-zones describe example-zone --format=yaml

# List all records in a zone
gcloud dns record-sets list --zone=example-zone --format="table(name, type, ttl, rrdatas)"

# Check DNS policy status
gcloud dns policies list --format="table(name, enableLogging, enableInboundForwarding)"

# Test DNS forwarding from GCP to on-premises
# (Run from a VM in the VPC with forwarding configured)
dig corporate-app.corp.internal @169.254.169.254

# Check for conflicting zones
gcloud dns managed-zones list \
  --format="table(name, dnsName, visibility, privateVisibilityConfig.networks)" \
  --filter="dnsName:internal.example.com."