# 3.3 Ensure That DNSSEC Is Enabled for Cloud DNS (Automated)

- Source: https://support.icompaas.com/support/solutions/articles/62000233007-33-ensure-that-dnssec-is-enabled-for-cloud-dns-automated
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178)
- Last updated: 2026-06-16
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### Profile Applicability:

Level 1

### Description:

Cloud DNS is a high-performance and cost-effective Domain Name System service provided by Google Cloud. Enabling Domain Name System Security Extensions (DNSSEC) for Cloud DNS enhances security by protecting domains from DNS hijacking, man-in-the-middle attacks, and other threats.

### Rationale:

DNSSEC enhances DNS protocol security by cryptographically signing DNS records. This ensures the authenticity and integrity of DNS responses and prevents attackers from redirecting users to malicious sites via DNS hijacking or issuing fake DNS responses. Enabling DNSSEC mitigates the risk of malicious redirection and builds trust in domain/IP lookups.

### Default Value:

By default, DNSSEC is not enabled for Cloud DNS zones.

### Audit Steps:

#### Using Google Cloud Console:

1.  Navigate to the [Cloud DNS page](https://console.cloud.google.com/netservices/dns/zones).
    

               ![](https://support.icompaas.com/assets/kb/3cb14e9ee578e25a.png)

2.  Review all DNS zones of type Public.
    

                ![](https://support.icompaas.com/assets/kb/ab2d8f7c69af1016.png)

3.  Verify that DNSSEC is set to On for each zone.
    

                 ![](https://support.icompaas.com/assets/kb/82be5a022f0d3bc5.png)

#### Using Google Cloud CLI:

List all managed DNS zones in the project:

gcloud dns managed-zones list

For each zone with visibility Public, retrieve metadata:

gcloud dns managed-zones describe ZONE\_NAME

1.  Check the dnssecConfig.state property. It should be set to on
    

### Remediation Steps:

#### Using Google Cloud Console:

1.  Navigate to the [Cloud DNS page](https://console.cloud.google.com/netservices/dns/zones).
    

                  ![](https://support.icompaas.com/assets/kb/e5c2fd7f737c6462.png)

2.  For each Public zone:
    
    -   **Click the zone name.**
        

                       **![](https://support.icompaas.com/assets/kb/622daa756d609f06.png)**

-   Set DNSSEC to On.
    

                         **![](https://support.icompaas.com/assets/kb/51be884e92ecbe55.png)**

#### **Using Google Cloud CLI:**

**Enable DNSSEC for a specific Cloud DNS zone:**

gcloud dns managed-zones update ZONE\_NAME --dnssec-state on

**References:**

1.  **[Google Cloud Blog: DNSSEC in Cloud DNS](https://cloudplatform.googleblog.com/2017/11/DNSSEC-now-available-in-CloudDNS.html)**
    
2.  **[Google Cloud Documentation: Enabling DNSSEC](https://cloud.google.com/dns/dnssec-config#enabling)**
    
3.  **[Google Cloud DNSSEC Overview](https://cloud.google.com/dns/dnssec)**
    

### **CIS Controls:**

<table style="width:678px;font-family:&quot;Helvetica Neue&quot;;font-weight:400;border-width:medium;border-style:none;border-color:currentcolor;border-image:initial"><tbody><tr style="height:41.5pt"><td style="border-color:rgb(226, 232, 240);border-style:solid;border-width:1px;border-image:none 100% / 1 / 0 stretch;padding:5pt;overflow:hidden;overflow-wrap:break-word"><p dir="ltr" style="margin:0px 0px 0pt;line-height:1.38;text-align:center"><strong><span style="font-size:13px"><span style="color:rgb(0, 0, 0)">Control</span></span></strong></p></td><td style="border-color:rgb(226, 232, 240);border-style:solid;border-width:1px;border-image:none 100% / 1 / 0 stretch;padding:5pt;overflow:hidden;overflow-wrap:break-word"><p dir="ltr" style="margin:0px 0px 0pt;line-height:1.38;text-align:center"><strong><span style="font-size:13px"><span style="color:rgb(0, 0, 0)">Description</span></span></strong></p></td><td style="border-color:rgb(226, 232, 240);border-style:solid;border-width:1px;border-image:none 100% / 1 / 0 stretch;padding:5pt;overflow:hidden;overflow-wrap:break-word"><p dir="ltr" style="margin:0px 0px 0pt;line-height:1.38;text-align:center"><strong><span style="font-size:13px"><span style="color:rgb(0, 0, 0)">IG 1</span></span></strong></p></td><td style="border-color:rgb(226, 232, 240);border-style:solid;border-width:1px;border-image:none 100% / 1 / 0 stretch;padding:5pt;overflow:hidden;overflow-wrap:break-word"><p dir="ltr" style="margin:0px 0px 0pt;line-height:1.38;text-align:center"><strong><span style="font-size:13px"><span style="color:rgb(0, 0, 0)">IG 2</span></span></strong></p></td><td style="border-color:rgb(226, 232, 240);border-style:solid;border-width:1px;border-image:none 100% / 1 / 0 stretch;padding:5pt;overflow:hidden;overflow-wrap:break-word"><p dir="ltr" style="margin:0px 0px 0pt;line-height:1.38;text-align:center"><strong><span style="font-size:13px"><span style="color:rgb(0, 0, 0)">IG 3</span></span></strong></p></td></tr><tr style="height:56.5pt"><td style="border-color:rgb(226, 232, 240);border-style:solid;border-width:1px;border-image:none 100% / 1 / 0 stretch;padding:5pt;overflow:hidden;overflow-wrap:break-word"><p dir="ltr" style="margin:0px 0px 0pt;line-height:1.38"><span style="font-size:13px"><span style="color:rgb(0, 0, 0)">4.2 Secure Configuration for Network Devices</span></span></p></td><td style="border-color:rgb(226, 232, 240);border-style:solid;border-width:1px;border-image:none 100% / 1 / 0 stretch;padding:5pt;overflow:hidden;overflow-wrap:break-word"><p dir="ltr" style="margin:0px 0px 0pt;line-height:1.38"><strong><span style="font-size:13px"><span style="color:rgb(0, 0, 0);font-weight:400">Maintain secure configuration for network devices, with annual reviews or after significant changes.</span></span></strong></p></td><td style="border-color:rgb(226, 232, 240);border-style:solid;border-width:1px;border-image:none 100% / 1 / 0 stretch;padding:5pt;overflow:hidden;overflow-wrap:break-word"><p dir="ltr" style="margin:0px 0px 0pt;line-height:1.38"><strong><span style="font-size:13px"><span style="color:rgb(0, 0, 0);font-weight:400">✅</span></span></strong></p></td><td style="border-color:rgb(226, 232, 240);border-style:solid;border-width:1px;border-image:none 100% / 1 / 0 stretch;padding:5pt;overflow:hidden;overflow-wrap:break-word"><p dir="ltr" style="margin:0px 0px 0pt;line-height:1.38"><strong><span style="font-size:13px"><span style="color:rgb(0, 0, 0);font-weight:400">✅</span></span></strong></p></td><td style="border-color:rgb(226, 232, 240);border-style:solid;border-width:1px;border-image:none 100% / 1 / 0 stretch;padding:5pt;overflow:hidden;overflow-wrap:break-word"><p dir="ltr" style="margin:0px 0px 0pt;line-height:1.38"><strong><span style="font-size:13px"><span style="color:rgb(0, 0, 0);font-weight:400">✅</span></span></strong></p></td></tr><tr style="height:56.5pt"><td style="border-color:rgb(226, 232, 240);border-style:solid;border-width:1px;border-image:none 100% / 1 / 0 stretch;padding:5pt;overflow:hidden;overflow-wrap:break-word"><p dir="ltr" style="margin:0px 0px 0pt;line-height:1.38"><span style="font-size:13px"><span style="color:rgb(0, 0, 0)">11.1 Standard Security Configurations</span></span></p></td><td style="border-color:rgb(226, 232, 240);border-style:solid;border-width:1px;border-image:none 100% / 1 / 0 stretch;padding:5pt;overflow:hidden;overflow-wrap:break-word"><p dir="ltr" style="margin:0px 0px 0pt;line-height:1.38"><strong><span style="font-size:13px"><span style="color:rgb(0, 0, 0);font-weight:400">Ensure all authorized network devices follow documented and secure configuration standards.</span></span></strong></p></td><td style="border-color:rgb(226, 232, 240);border-style:solid;border-width:1px;border-image:none 100% / 1 / 0 stretch;padding:5pt;overflow:hidden;overflow-wrap:break-word"><p dir="ltr" style="margin:0px 0px 0pt;line-height:1.38"><strong><span style="font-size:13px"><span style="color:rgb(0, 0, 0);font-weight:400">✅</span></span></strong></p></td><td style="border-color:rgb(226, 232, 240);border-style:solid;border-width:1px;border-image:none 100% / 1 / 0 stretch;padding:5pt;overflow:hidden;overflow-wrap:break-word"><p dir="ltr" style="margin:0px 0px 0pt;line-height:1.38"><strong><span style="font-size:13px"><span style="color:rgb(0, 0, 0);font-weight:400">✅</span></span></strong></p></td><td style="border-color:rgb(226, 232, 240);border-style:solid;border-width:1px;border-image:none 100% / 1 / 0 stretch;padding:5pt;overflow:hidden;overflow-wrap:break-word"></td></tr></tbody></table>

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.