Google Cloud DNS requirements for domain validation
Table of Contents
Expand all | Collapse all
-
- Activate Next-Generation Trust Security
-
-
- Configure AWS connection
- Configure Azure Key Vault connection
-
- Workload Identity Federation authentication
- Workload Identity Federation - Azure Identity Provider authentication
- Next-Gen Trust Security Generated Key authentication
- User permissions
- Workload Identity Federation authentication
- Next-Gen Trust Security Generated Key authentication
- User permissions
- Supported OIDC claims
-
-
-
-
- Create an F5 BIG-IP LTM machine
- Create a Microsoft Azure Private Key Vault machine
- Create a Microsoft IIS machine
- Create a Microsoft Windows (PowerShell) machine
- Create a Microsoft SQL Server machine
- Create a Common KeyStore machine
- Create a Citrix ADC machine
- Create an Imperva WAF machine
- Create a VMware NSX Advanced Load Balancer (AVI) machine
- Create an A10 Thunder ADC machine
- Create a Cloudflare machine
- Create Kemp Virtual LoadMaster machine
- Create a Palo Alto Panorama machine
-
- Provision to an F5 BIG-IP LTM
- Provision to a Microsoft Azure Private Key Vault
- Provision to Microsoft IIS
- Provision to Microsoft Windows (PowerShell)
- Provision to Microsoft SQL Server
- Provision to a Common KeyStore
- Provision to a Citrix ADC
- Provision to an Imperva WAF
- Provision to VMware NSX Advanced Load Balancer (AVI)
- Provision to an A10 Thunder ADC
- Provision to Cloudflare
- Provision to a Kemp Virtual LoadMaster
- Provision to Palo Alto Panorama
-
-
- 47-Day Validity Readiness TLS Certificates dashboard
- About the Certificate Inventory
- Managing certificate lifecycle settings
- Reissuing certificates in Next-Gen Trust Security
- Downloading certificates, certificate chains, and keystores
- Retiring, recovering, and deleting certificates
- Finding certificates in the certificate inventory
- Importing certificates from a CA using EJBCA
- Notification Center overview
- Domain-based validation for external emails
- Managing user accounts
- Troubleshooting
Google Cloud DNS requirements for domain validation
When using Google Cloud DNS with a certificate authority (CA) that supports the DNS-01 challenge method—such as Google Trust Services (GTS) or a custom ACMEv2 CA—Next-Gen Trust Security automates domain control validation by creating and deleting TXT records through the Google Cloud DNS API.
Required Google Cloud properties
These Google Cloud properties are required to enable secure automation with Google Cloud DNS:
| Field | Purpose |
|---|---|
| Service account JSON file | Authenticates API access to Google Cloud DNS using a service account credential. |
Required permissions
To allow Next-Gen Trust Security to create and manage TXT records automatically, the service account must include the following permissions in Google Cloud IAM.
Project-level permissions
| Permission | Purpose |
|---|---|
| dns.managedZones.list | Lists available managed zones in the project. |
| dns.projects.get | Retrieves project information and DNS quotas. |
DNS zone–level permissions
| Permission | Purpose |
|---|---|
| dns.changes.create | Creates DNS record changes for DNS-01 validation. |
| dns.changes.get | Retrieves details about DNS changes. |
| dns.resourceRecordSets.create | Adds TXT records required for validation. |
| dns.resourceRecordSets.delete | Removes TXT records after validation completes. |
| dns.resourceRecordSets.get | Reads specific DNS record details. |
| dns.resourceRecordSets.list | Lists existing DNS records in the zone. |
| dns.managedZonesOperations.list | Lists the status of long-running operations, such as DNS record updates, within a managed zone. Required for tracking asynchronous DNS changes during validation. |
| dns.resourceRecordSets.update | Updates existing DNS records when a new validation TXT record replaces an older entry or when a record must be modified instead of recreated. |
Tip: Need help configuring IAM roles?
See Google’s guides for Creating and Managing Service Accounts and Access Control for Cloud DNS.You may need assistance from a Google Cloud administrator to create a service account and assign custom roles.