How to Enable DNSSEC on GCP Cloud DNS?

 

What is DNSSEC?

DNSSEC (Domain Name System Security Extensions) adds cryptographic signatures to your DNS records. This verifies that the DNS responses weren't tampered with — it’s about authenticity, not encryption.

When you enable DNSSEC in Google Cloud DNS:

• GCP automatically signs your DNS zones (with private signing keys stored securely).

• DNS resolvers that validate DNSSEC will check signatures before accepting your records.

• If a DNS signature is invalid/missing, resolvers might reject your domain's responses.

When Should You Enable DNSSEC?

• If your domain is business-critical (finance, health, government, e-commerce).

• If you need security compliance (SOC 2, HIPAA, GDPR, FedRAMP, etc.).

• If you're comfortable managing DS records and understanding DNS troubleshooting.

• If you're using automatic key management in GCP (less risk).

How to Setup GCP DNSSEC?

Prepare Before Enabling

• Confirm that your domain registrar supports manual DS record updates.
  (Example: Google Domains, GoDaddy, Namecheap all support it.)

• Communicate with your team:
  "Enabling DNSSEC might cause short DNS disruption if DS records aren't updated immediately."

Enable DNSSEC on GCP Cloud DNS

• Go to Cloud Console → Network Services → Cloud DNS → your managed zone.

• Edit the zone → under "DNSSEC" settings:

  • Select "On".

• Save the changes.
  (Cloud DNS will start signing your zone immediately.)

Get the DS Record Info

• After DNSSEC is turned on, GCP will generate DS record details for you:

• Key Tag

• Algorithm

• Digest Type

• Digest

You'll need this exact info to set at your registrar.

Update DS Record at Your Registrar 

• Login to your domain registrar account (where you bought your domain).

• Find DNSSEC settings for your domain.

• Add a new DS record with the exact values from GCP.

Validate Everything

• Test DNSSEC using tools:

  • Google Dig Tool

  • DNSViz Analysis

  • dig +dnssec yourdomain.com from terminal.

• Make sure:

  • Responses have AD (Authenticated Data) flag 

  • No warnings about missing signatures

How to Find Out Who Your Domain Registrar Is:

Use a Public WHOIS Lookup

• Go to a site like:

  • https://lookup.icann.org/lookup (Official ICANN Lookup)

  • https://whois.domaintools.com/

  • https://who.is/

• Enter your domain name (e.g., example.com).

• Look for the field called Registrar in the results.

Example output:

Domain Name: example.com
Registrar: GoDaddy.com, LLC
Registrar IANA ID: 146
Registrar URL: http://www.godaddy.com

Here, GoDaddy is the registrar.

Use whois Command from Terminal (Linux/Mac/WSL)

If you prefer command line:

whois example.com

Then search for a line like:

Registrar: NAMECHEAP INC

That's your registrar.