Check for DNSSEC Zone-Signing Algorithm in Use

01 Sign in to Google Cloud Management Console.

02 Select the GCP project that you want to examine from the console top navigation bar.

03 Navigate to Cloud DNS dashboard at https://console.cloud.google.com/net-services/dns.

04 Select the Zones tab to access the list of DNS managed zones created for the selected project.

05 On the Zones panel, click inside the Filter by zone name, DNS name or description box, select Type and public, then press Enter. This will return only the public DNS managed zones available for the GCP project.

06 Click on the name of the public DNS zone that you want to examine to access the zone file configuration page.

07 On the selected DNS zone file page, click on the Equivalent REST link available at the bottom of the page to view the REST request body, which includes the JSON representation of the selected DNS zone.

08 Inside the Equivalent REST response dialog box, check the DNSSEC Zone-Signing Key (ZSK) algorithm set for the selected DNS zone (i.e. dnssecConfig.defaultKeySpecs.algorithm value for the object with the "keyType" set to "ZONE_SIGNING"). If the "algorithm" property value is set to "RSASHA1", the DNSSEC Zone-Signing Key (ZSK) algorithm configured for the selected DNS managed zone is considered deprecated and non-secure, and should not be used unless it is required for compatibility reasons.

09 Repeat steps no. 6 – 8 for every public DNS zone deployed within the selected GCP project.

10 Repeat steps no. 2 – 9 for each GCP project available in your Google Cloud account.

01 Run projects list command (Windows/macOS/Linux) using custom query filters to list the IDs of all the projects available in your Google Cloud account:

gcloud projects list
  --format="table(projectId)"

02 The command output should return the requested GCP project identifiers (IDs):

PROJECT_ID
cc-frontend-app-123123
cc-backend-app-112233

03 Run dns managed-zones list command (Windows/macOS/Linux) using the ID of the GCP project that you want to examine as identifier parameter and custom filtering to describe the name and the visibility of each DNS managed zone created for the selected project:

gcloud dns managed-zones list
  --project cc-frontend-app-123123
  --format="table(name,visibility)"

04 The command output should return the requested Google Cloud DNS zone metadata:

NAME VISIBILITY
cloudrealisation-dns-zone public
cloudconformity-dns-zone public

05 Run dns managed-zones describe command (Windows/macOS/Linux) using the name of the public DNS managed zone that you want to examine as identifier parameter and custom query filters to describe the DNSSEC extension configuration available for the selected DNS zone:

gcloud dns managed-zones describe cloudrealisation-dns-zone
  --format="json(dnssecConfig)"

06 The command output should return the requested configuration information in JSON format:

{
  "dnssecConfig": {
    "defaultKeySpecs": [
      {
        "algorithm": "rsasha1",
        "keyLength": 1024,
        "keyType": "keySigning",
        "kind": "dns#dnsKeySpec"
      },
      {
        "algorithm": "rsasha1",
        "keyLength": 1024,
        "keyType": "zoneSigning",
        "kind": "dns#dnsKeySpec"
      }
    ],
    "kind": "dns#managedZoneDnsSecConfig",
    "nonExistence": "nsec3",
    "state": "on"
  }
}

07 Repeat step no. 5 and 6 for every public DNS zone created within the selected Google Cloud Platform (GCP) project.

08 Repeat steps no. 3 – 7 for each GCP project deployed in your Google Cloud account.