GCP Prep
Browse all topics
Networking3 min readUpdated August 13, 2026

Cloud DNS

In one sentence

DNS turns names into addresses; Cloud DNS runs that translation for you, for both the public internet and your private network.

What it is

Cloud DNS is a managed authoritative name service. You create zones representing domains you control and records inside them mapping names to addresses or other names.

It serves both directions of the problem: public zones answer queries from anyone on the internet, and private zones answer queries only from within networks you specify.

Why it matters

DNS is a single point of failure for everything. If name resolution stops working, it does not matter how healthy your servers are — nobody can reach them. It is also a common source of confusing incidents, because caching means changes propagate unevenly and a problem can appear to affect only some users.

In hybrid environments it becomes a genuine design problem. Cloud resources need to resolve on-premises names, on-premises systems need to resolve cloud names, and the same name may need to resolve differently depending on who is asking.

Key concepts

  • Public zone — authoritative for a domain on the internet.
  • Private zone — resolvable only from VPC networks you authorise, for internal names that should not be public.
  • Record types — A and AAAA map to addresses; CNAME aliases one name to another; MX routes mail; TXT holds verification and policy data; NS delegates a subdomain.
  • TTL — how long resolvers may cache a record. Lower it in advance of a planned change, then raise it again afterwards.
  • Forwarding zone — sends queries for a domain to specific name servers, typically on-premises resolvers.
  • DNS peering — lets one VPC use another VPC's private zones, so a shared network can centralise resolution.
  • DNSSEC — cryptographically signs responses so resolvers can verify they were not tampered with.

Split-horizon resolution

  1. 1A public zone for example.com returns the load balancer's public address
  2. 2A private zone for the same name is authorised for your internal VPC
  3. 3A query from the internet reaches the public zone and receives the public address
  4. 4A query from inside the VPC matches the private zone first and receives an internal address
  5. 5Internal traffic stays on the private network without leaving it
The same name resolving differently depending on where the query comes from.

Common use cases

  • Hosting authoritative DNS for a company's public domains.
  • Private zones giving internal services stable names instead of IP addresses.
  • Forwarding zones so cloud workloads can resolve on-premises hostnames.
  • Split-horizon so internal traffic to a public hostname stays on the private network.
  • Lowering TTLs in advance of a migration to make cutover fast and reversible.

Certification relevance

Where this topic appears, and how deeply each exam goes into it. These are our own assessments based on published exam guides.

Practice questions

Networking practice questions

9 original questions with full explanations.