DNS and service discovery
Resolve private resource names and manage service DNS records.
DNS configuration provides private name resolution for project networks and managed records for verified zones. Public DNS publication and private service discovery have separate scopes.
Private resolution
A network's DNS settings specify resolver addresses and search domains. Supported images receive them through guest network configuration. Custom images must apply those settings themselves.
Private resource records are scoped to the network. Their names identify interfaces or configured service records, not every resource in the organization. Attaching another network does not grant access to its private zone without an explicit resolution and routing configuration.
Deleting an interface removes its managed private record after reconciliation. Resolver and client caches can retain earlier answers until their TTL expires. Use resource IDs for automation instead of assuming a name always maps to the same guest.
Manage a zone
Open Networking → DNS → Add zone. Enter the zone name and complete ownership verification. For a delegated public zone, update its authoritative nameservers at the registrar and verify delegation before relying on Infra records.
Use A for IPv4 and AAAA for IPv6. Use a CNAME for an alias to another hostname; it cannot coexist with other record data at that owner. MX requires a priority and mail hostname. SRV requires priority, weight, port, and target. TXT preserves the submitted text.
Treat a record set as the complete set of values for its owner and type. Replacing an A set must include every address that should remain published. The DNS API documents conditional replacement and publication state.
The default TTL is 300 seconds. Accepted TTL values are integer seconds from
30 through 86400, inclusive. Invalid values are rejected. Lower TTLs affect
newly served answers; they do not shorten a TTL already cached by a client.
Publish a service
Open Networking → DNS, select the zone, and create an A or AAAA record for a load balancer after its endpoint and health checks are ready. A DNS record does not monitor backend health or initiate failover by itself.
For a planned endpoint change, lower the TTL in advance, wait for the previous TTL to elapse, update the record, and observe both old and new endpoints during the transition. Keep the previous endpoint available while clients might still use its cached address.
Updates and permissions
Zone editors can change records only in their bound project or zone scope. Zone deletion removes managed records but cannot remove registrar delegation. Remove or change that delegation before deleting an authoritative zone.
Record updates appear as operations and audit events. A completed publication does not establish that all recursive resolvers have expired their caches.
Diagnose resolution
Compare the authoritative answer, configured recursive resolver, guest resolver, and application cache. Check the record's full name, type, TTL, and address family. A correct answer with failed connectivity requires investigation of routes, public address assignment, and firewall rules.