Regulatory support in Cloud DNS

This document describes the features, configurations and APIs in Cloud DNS that align with the controls for supported control packages. This document assumes that you're using Assured Workloads.

Data Boundary for ITAR

Supported services

The following table lists the Cloud DNS APIs and versions that meet the requirements of Data Boundary for ITAR.

Service Version Status
dns.googleapis.com v1 SUPPORTED
dns.googleapis.com v1alpha2 SUPPORTED
dns.googleapis.com v1beta2 SUPPORTED
dns.googleapis.com v2 SUPPORTED
dns.googleapis.com v2beta1 SUPPORTED

Compliance supported regions

Cloud DNS is available for Data Boundary for ITAR in the following Google Cloud regions:

  • us-central1
  • us-central2
  • us-east1
  • us-east4
  • us-east5
  • us-south1
  • us-west1
  • us-west2
  • us-west3
  • us-west4

Fields not intended for Sensitive data

The following table provides an illustrative list of field categories and specific fields that aren't suitable for sensitive information. To maintain compliance, avoid placing protected data in these fields. For a complete list, contact your Google Cloud representative.

Category Fields
Authentication and authorization
  • header.authorization
Client identifiers
  • header.abuse.metadata.clientIp
  • header.abuse.metadata.deviceIdHash
  • header.abuse.metadata.networkId
  • header.abuse.metadata.source
  • header.abuse.metadata.userAgent
  • header.abuse.metadata.userKey.id
DNS record set details
  • rrset.name
  • rrset.routingPolicy.geo.failovers.rrdatas
  • rrset.routingPolicy.geo.items.rrdatas
  • rrset.routingPolicy.wrr.items.rrdatas
  • rrset.rrdatas
  • rrset.type
GKE cluster information
  • policy.gkeClusters.gkeClusterName
  • policy.gkeClusters.internalGkeClusterHash
  • policyResource.gkeClusters.gkeClusterName
  • policyResource.gkeClusters.internalGkeClusterHash
  • responsePolicy.gkeClusters.gkeClusterName
  • responsePolicy.gkeClusters.internalGkeClusterHash
Managed zone configuration
  • managedZone
  • managedZone.description
  • managedZone.dnsName
  • managedZone.forwardingConfig.targetNameServers.ipv4Address
  • managedZone.forwardingConfig.targetNameServers.ipv6Address
  • managedZone.name
Network targeting
  • managedZone.privateVisibilityConfig.networks.networkUrl
  • managedZoneResource.privateVisibilityConfig.networks.networkUrl
  • policy.networks.networkUrl
  • policyResource.networks.networkUrl
  • responsePolicy.networks.networkUrl
  • targetNetwork
Policy configuration
  • policy
  • policy.description
  • policy.fingerprint
  • policy.name
Resource identifiers
  • change.id
  • managedZoneResource.name
  • policyResource.name
  • project
  • responsePolicy.responsePolicyName
  • responsePolicyRule.dnsName
Routing policy configurations
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.failovers.healthCheckedTargets.internalLoadBalancers.region
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.geoPolicy.items.healthCheckedTargets.internalLoadBalancers.ipAddress
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.failovers.signatureRrdatas
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.wrrPolicy.items.rrdatas
TSIG key configuration
  • tsigKey
  • tsigKey.fingerprint
  • tsigKey.key
  • tsigKey.name
  • tsigKeyResource.key
  • tsigKeyResource.name

AW Regional Controls - India Data Boundary

Supported services

The following table lists the Cloud DNS APIs and versions that meet the requirements of AW Regional Controls - India Data Boundary.

Service Version Status
dns.googleapis.com v1 SUPPORTED
dns.googleapis.com v1alpha2 SUPPORTED
dns.googleapis.com v1beta2 SUPPORTED
dns.googleapis.com v2 SUPPORTED
dns.googleapis.com v2beta1 SUPPORTED

Fields not intended for Sensitive data

The following table provides an illustrative list of field categories and specific fields that aren't suitable for sensitive information. To maintain compliance, avoid placing protected data in these fields. For a complete list, contact your Google Cloud representative.

Category Fields
Authentication and authorization
  • header.authorization
Client identifiers
  • header.abuse.metadata.clientIp
  • header.abuse.metadata.deviceIdHash
  • header.abuse.metadata.networkId
  • header.abuse.metadata.source
  • header.abuse.metadata.userAgent
  • header.abuse.metadata.userKey.id
DNS record set details
  • rrset.name
  • rrset.routingPolicy.geo.failovers.rrdatas
  • rrset.routingPolicy.geo.items.rrdatas
  • rrset.routingPolicy.wrr.items.rrdatas
  • rrset.rrdatas
  • rrset.type
GKE cluster information
  • policy.gkeClusters.gkeClusterName
  • policy.gkeClusters.internalGkeClusterHash
  • policyResource.gkeClusters.gkeClusterName
  • policyResource.gkeClusters.internalGkeClusterHash
  • responsePolicy.gkeClusters.gkeClusterName
  • responsePolicy.gkeClusters.internalGkeClusterHash
Managed zone configuration
  • managedZone
  • managedZone.description
  • managedZone.dnsName
  • managedZone.forwardingConfig.targetNameServers.ipv4Address
  • managedZone.forwardingConfig.targetNameServers.ipv6Address
  • managedZone.name
Network targeting
  • managedZone.privateVisibilityConfig.networks.networkUrl
  • managedZoneResource.privateVisibilityConfig.networks.networkUrl
  • policy.networks.networkUrl
  • policyResource.networks.networkUrl
  • responsePolicy.networks.networkUrl
  • targetNetwork
Policy configuration
  • policy
  • policy.description
  • policy.fingerprint
  • policy.name
Resource identifiers
  • change.id
  • managedZoneResource.name
  • policyResource.name
  • project
  • responsePolicy.responsePolicyName
  • responsePolicyRule.dnsName
Routing policy configurations
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.failovers.healthCheckedTargets.internalLoadBalancers.region
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.geoPolicy.items.healthCheckedTargets.internalLoadBalancers.ipAddress
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.failovers.signatureRrdatas
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.wrrPolicy.items.rrdatas
TSIG key configuration
  • tsigKey
  • tsigKey.fingerprint
  • tsigKey.key
  • tsigKey.name
  • tsigKeyResource.key
  • tsigKeyResource.name

AW Regional Controls - Premium - Australia Data Boundary and Support

Supported services

The following table lists the Cloud DNS APIs and versions that meet the requirements of AW Regional Controls - Premium - Australia Data Boundary and Support.

Service Version Status
dns.googleapis.com v1 SUPPORTED
dns.googleapis.com v1alpha2 SUPPORTED
dns.googleapis.com v1beta2 SUPPORTED
dns.googleapis.com v2 SUPPORTED
dns.googleapis.com v2beta1 SUPPORTED

Fields not intended for Sensitive data

The following table provides an illustrative list of field categories and specific fields that aren't suitable for sensitive information. To maintain compliance, avoid placing protected data in these fields. For a complete list, contact your Google Cloud representative.

Category Fields
Authentication and authorization
  • header.authorization
Client identifiers
  • header.abuse.metadata.clientIp
  • header.abuse.metadata.deviceIdHash
  • header.abuse.metadata.networkId
  • header.abuse.metadata.source
  • header.abuse.metadata.userAgent
  • header.abuse.metadata.userKey.id
DNS record set details
  • rrset.name
  • rrset.routingPolicy.geo.failovers.rrdatas
  • rrset.routingPolicy.geo.items.rrdatas
  • rrset.routingPolicy.wrr.items.rrdatas
  • rrset.rrdatas
  • rrset.type
GKE cluster information
  • policy.gkeClusters.gkeClusterName
  • policy.gkeClusters.internalGkeClusterHash
  • policyResource.gkeClusters.gkeClusterName
  • policyResource.gkeClusters.internalGkeClusterHash
  • responsePolicy.gkeClusters.gkeClusterName
  • responsePolicy.gkeClusters.internalGkeClusterHash
Managed zone configuration
  • managedZone
  • managedZone.description
  • managedZone.dnsName
  • managedZone.forwardingConfig.targetNameServers.ipv4Address
  • managedZone.forwardingConfig.targetNameServers.ipv6Address
  • managedZone.name
Network targeting
  • managedZone.privateVisibilityConfig.networks.networkUrl
  • managedZoneResource.privateVisibilityConfig.networks.networkUrl
  • policy.networks.networkUrl
  • policyResource.networks.networkUrl
  • responsePolicy.networks.networkUrl
  • targetNetwork
Policy configuration
  • policy
  • policy.description
  • policy.fingerprint
  • policy.name
Resource identifiers
  • change.id
  • managedZoneResource.name
  • policyResource.name
  • project
  • responsePolicy.responsePolicyName
  • responsePolicyRule.dnsName
Routing policy configurations
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.failovers.healthCheckedTargets.internalLoadBalancers.region
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.geoPolicy.items.healthCheckedTargets.internalLoadBalancers.ipAddress
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.failovers.signatureRrdatas
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.wrrPolicy.items.rrdatas
TSIG key configuration
  • tsigKey
  • tsigKey.fingerprint
  • tsigKey.key
  • tsigKey.name
  • tsigKeyResource.key
  • tsigKeyResource.name

AW Regional Controls - Premium - Canada Data Boundary and Support

Supported services

The following table lists the Cloud DNS APIs and versions that meet the requirements of AW Regional Controls - Premium - Canada Data Boundary and Support.

Service Version Status
dns.googleapis.com v1 SUPPORTED
dns.googleapis.com v1alpha2 SUPPORTED
dns.googleapis.com v1beta2 SUPPORTED
dns.googleapis.com v2 SUPPORTED
dns.googleapis.com v2beta1 SUPPORTED

Fields not intended for Sensitive data

The following table provides an illustrative list of field categories and specific fields that aren't suitable for sensitive information. To maintain compliance, avoid placing protected data in these fields. For a complete list, contact your Google Cloud representative.

Category Fields
Authentication and authorization
  • header.authorization
Client identifiers
  • header.abuse.metadata.clientIp
  • header.abuse.metadata.deviceIdHash
  • header.abuse.metadata.networkId
  • header.abuse.metadata.source
  • header.abuse.metadata.userAgent
  • header.abuse.metadata.userKey.id
DNS record set details
  • rrset.name
  • rrset.routingPolicy.geo.failovers.rrdatas
  • rrset.routingPolicy.geo.items.rrdatas
  • rrset.routingPolicy.wrr.items.rrdatas
  • rrset.rrdatas
  • rrset.type
GKE cluster information
  • policy.gkeClusters.gkeClusterName
  • policy.gkeClusters.internalGkeClusterHash
  • policyResource.gkeClusters.gkeClusterName
  • policyResource.gkeClusters.internalGkeClusterHash
  • responsePolicy.gkeClusters.gkeClusterName
  • responsePolicy.gkeClusters.internalGkeClusterHash
Managed zone configuration
  • managedZone
  • managedZone.description
  • managedZone.dnsName
  • managedZone.forwardingConfig.targetNameServers.ipv4Address
  • managedZone.forwardingConfig.targetNameServers.ipv6Address
  • managedZone.name
Network targeting
  • managedZone.privateVisibilityConfig.networks.networkUrl
  • managedZoneResource.privateVisibilityConfig.networks.networkUrl
  • policy.networks.networkUrl
  • policyResource.networks.networkUrl
  • responsePolicy.networks.networkUrl
  • targetNetwork
Policy configuration
  • policy
  • policy.description
  • policy.fingerprint
  • policy.name
Resource identifiers
  • change.id
  • managedZoneResource.name
  • policyResource.name
  • project
  • responsePolicy.responsePolicyName
  • responsePolicyRule.dnsName
Routing policy configurations
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.failovers.healthCheckedTargets.internalLoadBalancers.region
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.geoPolicy.items.healthCheckedTargets.internalLoadBalancers.ipAddress
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.failovers.signatureRrdatas
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.wrrPolicy.items.rrdatas
TSIG key configuration
  • tsigKey
  • tsigKey.fingerprint
  • tsigKey.key
  • tsigKey.name
  • tsigKeyResource.key
  • tsigKeyResource.name

AW Regional Controls - Premium - EU Data Boundary and Support

Supported services

The following table lists the Cloud DNS APIs and versions that meet the requirements of AW Regional Controls - Premium - EU Data Boundary and Support.

Service Version Status
dns.googleapis.com v1 SUPPORTED
dns.googleapis.com v1alpha2 SUPPORTED
dns.googleapis.com v1beta2 SUPPORTED
dns.googleapis.com v2 SUPPORTED
dns.googleapis.com v2beta1 SUPPORTED

Fields not intended for Sensitive data

The following table provides an illustrative list of field categories and specific fields that aren't suitable for sensitive information. To maintain compliance, avoid placing protected data in these fields. For a complete list, contact your Google Cloud representative.

Category Fields
Authentication and authorization
  • header.authorization
Client identifiers
  • header.abuse.metadata.clientIp
  • header.abuse.metadata.deviceIdHash
  • header.abuse.metadata.networkId
  • header.abuse.metadata.source
  • header.abuse.metadata.userAgent
  • header.abuse.metadata.userKey.id
DNS record set details
  • rrset.name
  • rrset.routingPolicy.geo.failovers.rrdatas
  • rrset.routingPolicy.geo.items.rrdatas
  • rrset.routingPolicy.wrr.items.rrdatas
  • rrset.rrdatas
  • rrset.type
GKE cluster information
  • policy.gkeClusters.gkeClusterName
  • policy.gkeClusters.internalGkeClusterHash
  • policyResource.gkeClusters.gkeClusterName
  • policyResource.gkeClusters.internalGkeClusterHash
  • responsePolicy.gkeClusters.gkeClusterName
  • responsePolicy.gkeClusters.internalGkeClusterHash
Managed zone configuration
  • managedZone
  • managedZone.description
  • managedZone.dnsName
  • managedZone.forwardingConfig.targetNameServers.ipv4Address
  • managedZone.forwardingConfig.targetNameServers.ipv6Address
  • managedZone.name
Network targeting
  • managedZone.privateVisibilityConfig.networks.networkUrl
  • managedZoneResource.privateVisibilityConfig.networks.networkUrl
  • policy.networks.networkUrl
  • policyResource.networks.networkUrl
  • responsePolicy.networks.networkUrl
  • targetNetwork
Policy configuration
  • policy
  • policy.description
  • policy.fingerprint
  • policy.name
Resource identifiers
  • change.id
  • managedZoneResource.name
  • policyResource.name
  • project
  • responsePolicy.responsePolicyName
  • responsePolicyRule.dnsName
Routing policy configurations
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.failovers.healthCheckedTargets.internalLoadBalancers.region
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.geoPolicy.items.healthCheckedTargets.internalLoadBalancers.ipAddress
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.failovers.signatureRrdatas
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.wrrPolicy.items.rrdatas
TSIG key configuration
  • tsigKey
  • tsigKey.fingerprint
  • tsigKey.key
  • tsigKey.name
  • tsigKeyResource.key
  • tsigKeyResource.name

AW Regional Controls - Premium - Israel Data Boundary and Support

Supported services

The following table lists the Cloud DNS APIs and versions that meet the requirements of AW Regional Controls - Premium - Israel Data Boundary and Support.

Service Version Status
dns.googleapis.com v1 SUPPORTED
dns.googleapis.com v1alpha2 SUPPORTED
dns.googleapis.com v1beta2 SUPPORTED
dns.googleapis.com v2 SUPPORTED
dns.googleapis.com v2beta1 SUPPORTED

Fields not intended for Sensitive data

The following table provides an illustrative list of field categories and specific fields that aren't suitable for sensitive information. To maintain compliance, avoid placing protected data in these fields. For a complete list, contact your Google Cloud representative.

Category Fields
Authentication and authorization
  • header.authorization
Client identifiers
  • header.abuse.metadata.clientIp
  • header.abuse.metadata.deviceIdHash
  • header.abuse.metadata.networkId
  • header.abuse.metadata.source
  • header.abuse.metadata.userAgent
  • header.abuse.metadata.userKey.id
DNS record set details
  • rrset.name
  • rrset.routingPolicy.geo.failovers.rrdatas
  • rrset.routingPolicy.geo.items.rrdatas
  • rrset.routingPolicy.wrr.items.rrdatas
  • rrset.rrdatas
  • rrset.type
GKE cluster information
  • policy.gkeClusters.gkeClusterName
  • policy.gkeClusters.internalGkeClusterHash
  • policyResource.gkeClusters.gkeClusterName
  • policyResource.gkeClusters.internalGkeClusterHash
  • responsePolicy.gkeClusters.gkeClusterName
  • responsePolicy.gkeClusters.internalGkeClusterHash
Managed zone configuration
  • managedZone
  • managedZone.description
  • managedZone.dnsName
  • managedZone.forwardingConfig.targetNameServers.ipv4Address
  • managedZone.forwardingConfig.targetNameServers.ipv6Address
  • managedZone.name
Network targeting
  • managedZone.privateVisibilityConfig.networks.networkUrl
  • managedZoneResource.privateVisibilityConfig.networks.networkUrl
  • policy.networks.networkUrl
  • policyResource.networks.networkUrl
  • responsePolicy.networks.networkUrl
  • targetNetwork
Policy configuration
  • policy
  • policy.description
  • policy.fingerprint
  • policy.name
Resource identifiers
  • change.id
  • managedZoneResource.name
  • policyResource.name
  • project
  • responsePolicy.responsePolicyName
  • responsePolicyRule.dnsName
Routing policy configurations
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.failovers.healthCheckedTargets.internalLoadBalancers.region
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.geoPolicy.items.healthCheckedTargets.internalLoadBalancers.ipAddress
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.failovers.signatureRrdatas
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.wrrPolicy.items.rrdatas
TSIG key configuration
  • tsigKey
  • tsigKey.fingerprint
  • tsigKey.key
  • tsigKey.name
  • tsigKeyResource.key
  • tsigKeyResource.name

AW Regional Controls - Premium - Japan Data Boundary

Supported services

The following table lists the Cloud DNS APIs and versions that meet the requirements of AW Regional Controls - Premium - Japan Data Boundary.

Service Version Status
dns.googleapis.com v1 SUPPORTED
dns.googleapis.com v1alpha2 SUPPORTED
dns.googleapis.com v1beta2 SUPPORTED
dns.googleapis.com v2 SUPPORTED
dns.googleapis.com v2beta1 SUPPORTED

Fields not intended for Sensitive data

The following table provides an illustrative list of field categories and specific fields that aren't suitable for sensitive information. To maintain compliance, avoid placing protected data in these fields. For a complete list, contact your Google Cloud representative.

Category Fields
Authentication and authorization
  • header.authorization
Client identifiers
  • header.abuse.metadata.clientIp
  • header.abuse.metadata.deviceIdHash
  • header.abuse.metadata.networkId
  • header.abuse.metadata.source
  • header.abuse.metadata.userAgent
  • header.abuse.metadata.userKey.id
DNS record set details
  • rrset.name
  • rrset.routingPolicy.geo.failovers.rrdatas
  • rrset.routingPolicy.geo.items.rrdatas
  • rrset.routingPolicy.wrr.items.rrdatas
  • rrset.rrdatas
  • rrset.type
GKE cluster information
  • policy.gkeClusters.gkeClusterName
  • policy.gkeClusters.internalGkeClusterHash
  • policyResource.gkeClusters.gkeClusterName
  • policyResource.gkeClusters.internalGkeClusterHash
  • responsePolicy.gkeClusters.gkeClusterName
  • responsePolicy.gkeClusters.internalGkeClusterHash
Managed zone configuration
  • managedZone
  • managedZone.description
  • managedZone.dnsName
  • managedZone.forwardingConfig.targetNameServers.ipv4Address
  • managedZone.forwardingConfig.targetNameServers.ipv6Address
  • managedZone.name
Network targeting
  • managedZone.privateVisibilityConfig.networks.networkUrl
  • managedZoneResource.privateVisibilityConfig.networks.networkUrl
  • policy.networks.networkUrl
  • policyResource.networks.networkUrl
  • responsePolicy.networks.networkUrl
  • targetNetwork
Policy configuration
  • policy
  • policy.description
  • policy.fingerprint
  • policy.name
Resource identifiers
  • change.id
  • managedZoneResource.name
  • policyResource.name
  • project
  • responsePolicy.responsePolicyName
  • responsePolicyRule.dnsName
Routing policy configurations
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.failovers.healthCheckedTargets.internalLoadBalancers.region
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.geoPolicy.items.healthCheckedTargets.internalLoadBalancers.ipAddress
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.failovers.signatureRrdatas
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.wrrPolicy.items.rrdatas
TSIG key configuration
  • tsigKey
  • tsigKey.fingerprint
  • tsigKey.key
  • tsigKey.name
  • tsigKeyResource.key
  • tsigKeyResource.name

AW Regional Controls - Premium - US Data Boundary and Support

Supported services

The following table lists the Cloud DNS APIs and versions that meet the requirements of AW Regional Controls - Premium - US Data Boundary and Support.

Service Version Status
dns.googleapis.com v1 SUPPORTED
dns.googleapis.com v1alpha2 SUPPORTED
dns.googleapis.com v1beta2 SUPPORTED
dns.googleapis.com v2 SUPPORTED
dns.googleapis.com v2beta1 SUPPORTED

Fields not intended for Sensitive data

The following table provides an illustrative list of field categories and specific fields that aren't suitable for sensitive information. To maintain compliance, avoid placing protected data in these fields. For a complete list, contact your Google Cloud representative.

Category Fields
Authentication and authorization
  • header.authorization
Client identifiers
  • header.abuse.metadata.clientIp
  • header.abuse.metadata.deviceIdHash
  • header.abuse.metadata.networkId
  • header.abuse.metadata.source
  • header.abuse.metadata.userAgent
  • header.abuse.metadata.userKey.id
DNS record set details
  • rrset.name
  • rrset.routingPolicy.geo.failovers.rrdatas
  • rrset.routingPolicy.geo.items.rrdatas
  • rrset.routingPolicy.wrr.items.rrdatas
  • rrset.rrdatas
  • rrset.type
GKE cluster information
  • policy.gkeClusters.gkeClusterName
  • policy.gkeClusters.internalGkeClusterHash
  • policyResource.gkeClusters.gkeClusterName
  • policyResource.gkeClusters.internalGkeClusterHash
  • responsePolicy.gkeClusters.gkeClusterName
  • responsePolicy.gkeClusters.internalGkeClusterHash
Managed zone configuration
  • managedZone
  • managedZone.description
  • managedZone.dnsName
  • managedZone.forwardingConfig.targetNameServers.ipv4Address
  • managedZone.forwardingConfig.targetNameServers.ipv6Address
  • managedZone.name
Network targeting
  • managedZone.privateVisibilityConfig.networks.networkUrl
  • managedZoneResource.privateVisibilityConfig.networks.networkUrl
  • policy.networks.networkUrl
  • policyResource.networks.networkUrl
  • responsePolicy.networks.networkUrl
  • targetNetwork
Policy configuration
  • policy
  • policy.description
  • policy.fingerprint
  • policy.name
Resource identifiers
  • change.id
  • managedZoneResource.name
  • policyResource.name
  • project
  • responsePolicy.responsePolicyName
  • responsePolicyRule.dnsName
Routing policy configurations
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.failovers.healthCheckedTargets.internalLoadBalancers.region
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.geoPolicy.items.healthCheckedTargets.internalLoadBalancers.ipAddress
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.failovers.signatureRrdatas
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.wrrPolicy.items.rrdatas
TSIG key configuration
  • tsigKey
  • tsigKey.fingerprint
  • tsigKey.key
  • tsigKey.name
  • tsigKeyResource.key
  • tsigKeyResource.name

Data Boundary for CJIS

Supported services

The following table lists the Cloud DNS APIs and versions that meet the requirements of Data Boundary for CJIS.

Service Version Status
dns.googleapis.com v1 SUPPORTED
dns.googleapis.com v1alpha2 SUPPORTED
dns.googleapis.com v1beta2 SUPPORTED
dns.googleapis.com v2 SUPPORTED
dns.googleapis.com v2beta1 SUPPORTED

Fields not intended for Sensitive data

The following table provides an illustrative list of field categories and specific fields that aren't suitable for sensitive information. To maintain compliance, avoid placing protected data in these fields. For a complete list, contact your Google Cloud representative.

Category Fields
Authentication and authorization
  • header.authorization
Client identifiers
  • header.abuse.metadata.clientIp
  • header.abuse.metadata.deviceIdHash
  • header.abuse.metadata.networkId
  • header.abuse.metadata.source
  • header.abuse.metadata.userAgent
  • header.abuse.metadata.userKey.id
DNS record set details
  • rrset.name
  • rrset.routingPolicy.geo.failovers.rrdatas
  • rrset.routingPolicy.geo.items.rrdatas
  • rrset.routingPolicy.wrr.items.rrdatas
  • rrset.rrdatas
  • rrset.type
GKE cluster information
  • policy.gkeClusters.gkeClusterName
  • policy.gkeClusters.internalGkeClusterHash
  • policyResource.gkeClusters.gkeClusterName
  • policyResource.gkeClusters.internalGkeClusterHash
  • responsePolicy.gkeClusters.gkeClusterName
  • responsePolicy.gkeClusters.internalGkeClusterHash
Managed zone configuration
  • managedZone
  • managedZone.description
  • managedZone.dnsName
  • managedZone.forwardingConfig.targetNameServers.ipv4Address
  • managedZone.forwardingConfig.targetNameServers.ipv6Address
  • managedZone.name
Network targeting
  • managedZone.privateVisibilityConfig.networks.networkUrl
  • managedZoneResource.privateVisibilityConfig.networks.networkUrl
  • policy.networks.networkUrl
  • policyResource.networks.networkUrl
  • responsePolicy.networks.networkUrl
  • targetNetwork
Policy configuration
  • policy
  • policy.description
  • policy.fingerprint
  • policy.name
Resource identifiers
  • change.id
  • managedZoneResource.name
  • policyResource.name
  • project
  • responsePolicy.responsePolicyName
  • responsePolicyRule.dnsName
Routing policy configurations
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.failovers.healthCheckedTargets.internalLoadBalancers.region
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.geoPolicy.items.healthCheckedTargets.internalLoadBalancers.ipAddress
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.failovers.signatureRrdatas
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.wrrPolicy.items.rrdatas
TSIG key configuration
  • tsigKey
  • tsigKey.fingerprint
  • tsigKey.key
  • tsigKey.name
  • tsigKeyResource.key
  • tsigKeyResource.name

Data Boundary for Canada Controlled Goods

Supported services

The following table lists the Cloud DNS APIs and versions that meet the requirements of Data Boundary for Canada Controlled Goods.

Service Version Status
dns.googleapis.com v1 SUPPORTED
dns.googleapis.com v1alpha2 SUPPORTED
dns.googleapis.com v1beta2 SUPPORTED
dns.googleapis.com v2 SUPPORTED
dns.googleapis.com v2beta1 SUPPORTED

Fields not intended for Sensitive data

The following table provides an illustrative list of field categories and specific fields that aren't suitable for sensitive information. To maintain compliance, avoid placing protected data in these fields. For a complete list, contact your Google Cloud representative.

Category Fields
Authentication and authorization
  • header.authorization
Client identifiers
  • header.abuse.metadata.clientIp
  • header.abuse.metadata.deviceIdHash
  • header.abuse.metadata.networkId
  • header.abuse.metadata.source
  • header.abuse.metadata.userAgent
  • header.abuse.metadata.userKey.id
DNS record set details
  • rrset.name
  • rrset.routingPolicy.geo.failovers.rrdatas
  • rrset.routingPolicy.geo.items.rrdatas
  • rrset.routingPolicy.wrr.items.rrdatas
  • rrset.rrdatas
  • rrset.type
GKE cluster information
  • policy.gkeClusters.gkeClusterName
  • policy.gkeClusters.internalGkeClusterHash
  • policyResource.gkeClusters.gkeClusterName
  • policyResource.gkeClusters.internalGkeClusterHash
  • responsePolicy.gkeClusters.gkeClusterName
  • responsePolicy.gkeClusters.internalGkeClusterHash
Managed zone configuration
  • managedZone
  • managedZone.description
  • managedZone.dnsName
  • managedZone.forwardingConfig.targetNameServers.ipv4Address
  • managedZone.forwardingConfig.targetNameServers.ipv6Address
  • managedZone.name
Network targeting
  • managedZone.privateVisibilityConfig.networks.networkUrl
  • managedZoneResource.privateVisibilityConfig.networks.networkUrl
  • policy.networks.networkUrl
  • policyResource.networks.networkUrl
  • responsePolicy.networks.networkUrl
  • targetNetwork
Policy configuration
  • policy
  • policy.description
  • policy.fingerprint
  • policy.name
Resource identifiers
  • change.id
  • managedZoneResource.name
  • policyResource.name
  • project
  • responsePolicy.responsePolicyName
  • responsePolicyRule.dnsName
Routing policy configurations
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.failovers.healthCheckedTargets.internalLoadBalancers.region
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.geoPolicy.items.healthCheckedTargets.internalLoadBalancers.ipAddress
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.failovers.signatureRrdatas
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.wrrPolicy.items.rrdatas
TSIG key configuration
  • tsigKey
  • tsigKey.fingerprint
  • tsigKey.key
  • tsigKey.name
  • tsigKeyResource.key
  • tsigKeyResource.name

Data Boundary for Canada Protected B

Supported services

The following table lists the Cloud DNS APIs and versions that meet the requirements of Data Boundary for Canada Protected B.

Service Version Status
dns.googleapis.com v1 SUPPORTED
dns.googleapis.com v1alpha2 SUPPORTED
dns.googleapis.com v1beta2 SUPPORTED
dns.googleapis.com v2 SUPPORTED
dns.googleapis.com v2beta1 SUPPORTED

Fields not intended for Sensitive data

The following table provides an illustrative list of field categories and specific fields that aren't suitable for sensitive information. To maintain compliance, avoid placing protected data in these fields. For a complete list, contact your Google Cloud representative.

Category Fields
Authentication and authorization
  • header.authorization
Client identifiers
  • header.abuse.metadata.clientIp
  • header.abuse.metadata.deviceIdHash
  • header.abuse.metadata.networkId
  • header.abuse.metadata.source
  • header.abuse.metadata.userAgent
  • header.abuse.metadata.userKey.id
DNS record set details
  • rrset.name
  • rrset.routingPolicy.geo.failovers.rrdatas
  • rrset.routingPolicy.geo.items.rrdatas
  • rrset.routingPolicy.wrr.items.rrdatas
  • rrset.rrdatas
  • rrset.type
GKE cluster information
  • policy.gkeClusters.gkeClusterName
  • policy.gkeClusters.internalGkeClusterHash
  • policyResource.gkeClusters.gkeClusterName
  • policyResource.gkeClusters.internalGkeClusterHash
  • responsePolicy.gkeClusters.gkeClusterName
  • responsePolicy.gkeClusters.internalGkeClusterHash
Managed zone configuration
  • managedZone
  • managedZone.description
  • managedZone.dnsName
  • managedZone.forwardingConfig.targetNameServers.ipv4Address
  • managedZone.forwardingConfig.targetNameServers.ipv6Address
  • managedZone.name
Network targeting
  • managedZone.privateVisibilityConfig.networks.networkUrl
  • managedZoneResource.privateVisibilityConfig.networks.networkUrl
  • policy.networks.networkUrl
  • policyResource.networks.networkUrl
  • responsePolicy.networks.networkUrl
  • targetNetwork
Policy configuration
  • policy
  • policy.description
  • policy.fingerprint
  • policy.name
Resource identifiers
  • change.id
  • managedZoneResource.name
  • policyResource.name
  • project
  • responsePolicy.responsePolicyName
  • responsePolicyRule.dnsName
Routing policy configurations
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.failovers.healthCheckedTargets.internalLoadBalancers.region
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.geoPolicy.items.healthCheckedTargets.internalLoadBalancers.ipAddress
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.failovers.signatureRrdatas
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.wrrPolicy.items.rrdatas
TSIG key configuration
  • tsigKey
  • tsigKey.fingerprint
  • tsigKey.key
  • tsigKey.name
  • tsigKeyResource.key
  • tsigKeyResource.name

Data Boundary for FedRAMP High

Supported services

The following table lists the Cloud DNS APIs and versions that meet the requirements of Data Boundary for FedRAMP High.

Service Version Status
dns.googleapis.com v1 SUPPORTED
dns.googleapis.com v1alpha2 SUPPORTED
dns.googleapis.com v1beta2 SUPPORTED
dns.googleapis.com v2 SUPPORTED
dns.googleapis.com v2beta1 SUPPORTED

Fields not intended for Sensitive data

The following table provides an illustrative list of field categories and specific fields that aren't suitable for sensitive information. To maintain compliance, avoid placing protected data in these fields. For a complete list, contact your Google Cloud representative.

Category Fields
Authentication and authorization
  • header.authorization
Client identifiers
  • header.abuse.metadata.clientIp
  • header.abuse.metadata.deviceIdHash
  • header.abuse.metadata.networkId
  • header.abuse.metadata.source
  • header.abuse.metadata.userAgent
  • header.abuse.metadata.userKey.id
DNS record set details
  • rrset.name
  • rrset.routingPolicy.geo.failovers.rrdatas
  • rrset.routingPolicy.geo.items.rrdatas
  • rrset.routingPolicy.wrr.items.rrdatas
  • rrset.rrdatas
  • rrset.type
GKE cluster information
  • policy.gkeClusters.gkeClusterName
  • policy.gkeClusters.internalGkeClusterHash
  • policyResource.gkeClusters.gkeClusterName
  • policyResource.gkeClusters.internalGkeClusterHash
  • responsePolicy.gkeClusters.gkeClusterName
  • responsePolicy.gkeClusters.internalGkeClusterHash
Managed zone configuration
  • managedZone
  • managedZone.description
  • managedZone.dnsName
  • managedZone.forwardingConfig.targetNameServers.ipv4Address
  • managedZone.forwardingConfig.targetNameServers.ipv6Address
  • managedZone.name
Network targeting
  • managedZone.privateVisibilityConfig.networks.networkUrl
  • managedZoneResource.privateVisibilityConfig.networks.networkUrl
  • policy.networks.networkUrl
  • policyResource.networks.networkUrl
  • responsePolicy.networks.networkUrl
  • targetNetwork
Policy configuration
  • policy
  • policy.description
  • policy.fingerprint
  • policy.name
Resource identifiers
  • change.id
  • managedZoneResource.name
  • policyResource.name
  • project
  • responsePolicy.responsePolicyName
  • responsePolicyRule.dnsName
Routing policy configurations
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.failovers.healthCheckedTargets.internalLoadBalancers.region
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.geoPolicy.items.healthCheckedTargets.internalLoadBalancers.ipAddress
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.failovers.signatureRrdatas
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.wrrPolicy.items.rrdatas
TSIG key configuration
  • tsigKey
  • tsigKey.fingerprint
  • tsigKey.key
  • tsigKey.name
  • tsigKeyResource.key
  • tsigKeyResource.name

Data Boundary for FedRAMP Moderate

Supported services

The following table lists the Cloud DNS APIs and versions that meet the requirements of Data Boundary for FedRAMP Moderate.

Service Version Status
dns.googleapis.com v1 SUPPORTED
dns.googleapis.com v1alpha2 SUPPORTED
dns.googleapis.com v1beta2 SUPPORTED
dns.googleapis.com v2 SUPPORTED
dns.googleapis.com v2beta1 SUPPORTED

Fields not intended for Sensitive data

The following table provides an illustrative list of field categories and specific fields that aren't suitable for sensitive information. To maintain compliance, avoid placing protected data in these fields. For a complete list, contact your Google Cloud representative.

Category Fields
Authentication and authorization
  • header.authorization
Client identifiers
  • header.abuse.metadata.clientIp
  • header.abuse.metadata.deviceIdHash
  • header.abuse.metadata.networkId
  • header.abuse.metadata.source
  • header.abuse.metadata.userAgent
  • header.abuse.metadata.userKey.id
DNS record set details
  • rrset.name
  • rrset.routingPolicy.geo.failovers.rrdatas
  • rrset.routingPolicy.geo.items.rrdatas
  • rrset.routingPolicy.wrr.items.rrdatas
  • rrset.rrdatas
  • rrset.type
GKE cluster information
  • policy.gkeClusters.gkeClusterName
  • policy.gkeClusters.internalGkeClusterHash
  • policyResource.gkeClusters.gkeClusterName
  • policyResource.gkeClusters.internalGkeClusterHash
  • responsePolicy.gkeClusters.gkeClusterName
  • responsePolicy.gkeClusters.internalGkeClusterHash
Managed zone configuration
  • managedZone
  • managedZone.description
  • managedZone.dnsName
  • managedZone.forwardingConfig.targetNameServers.ipv4Address
  • managedZone.forwardingConfig.targetNameServers.ipv6Address
  • managedZone.name
Network targeting
  • managedZone.privateVisibilityConfig.networks.networkUrl
  • managedZoneResource.privateVisibilityConfig.networks.networkUrl
  • policy.networks.networkUrl
  • policyResource.networks.networkUrl
  • responsePolicy.networks.networkUrl
  • targetNetwork
Policy configuration
  • policy
  • policy.description
  • policy.fingerprint
  • policy.name
Resource identifiers
  • change.id
  • managedZoneResource.name
  • policyResource.name
  • project
  • responsePolicy.responsePolicyName
  • responsePolicyRule.dnsName
Routing policy configurations
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.failovers.healthCheckedTargets.internalLoadBalancers.region
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.geoPolicy.items.healthCheckedTargets.internalLoadBalancers.ipAddress
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.failovers.signatureRrdatas
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.wrrPolicy.items.rrdatas
TSIG key configuration
  • tsigKey
  • tsigKey.fingerprint
  • tsigKey.key
  • tsigKey.name
  • tsigKeyResource.key
  • tsigKeyResource.name

Data Boundary for IRS Publication 1075

Supported services

The following table lists the Cloud DNS APIs and versions that meet the requirements of Data Boundary for IRS Publication 1075.

Service Version Status
dns.googleapis.com v1 SUPPORTED
dns.googleapis.com v1alpha2 SUPPORTED
dns.googleapis.com v1beta2 SUPPORTED
dns.googleapis.com v2 SUPPORTED
dns.googleapis.com v2beta1 SUPPORTED

Fields not intended for Sensitive data

The following table provides an illustrative list of field categories and specific fields that aren't suitable for sensitive information. To maintain compliance, avoid placing protected data in these fields. For a complete list, contact your Google Cloud representative.

Category Fields
Authentication and authorization
  • header.authorization
Client identifiers
  • header.abuse.metadata.clientIp
  • header.abuse.metadata.deviceIdHash
  • header.abuse.metadata.networkId
  • header.abuse.metadata.source
  • header.abuse.metadata.userAgent
  • header.abuse.metadata.userKey.id
DNS record set details
  • rrset.name
  • rrset.routingPolicy.geo.failovers.rrdatas
  • rrset.routingPolicy.geo.items.rrdatas
  • rrset.routingPolicy.wrr.items.rrdatas
  • rrset.rrdatas
  • rrset.type
GKE cluster information
  • policy.gkeClusters.gkeClusterName
  • policy.gkeClusters.internalGkeClusterHash
  • policyResource.gkeClusters.gkeClusterName
  • policyResource.gkeClusters.internalGkeClusterHash
  • responsePolicy.gkeClusters.gkeClusterName
  • responsePolicy.gkeClusters.internalGkeClusterHash
Managed zone configuration
  • managedZone
  • managedZone.description
  • managedZone.dnsName
  • managedZone.forwardingConfig.targetNameServers.ipv4Address
  • managedZone.forwardingConfig.targetNameServers.ipv6Address
  • managedZone.name
Network targeting
  • managedZone.privateVisibilityConfig.networks.networkUrl
  • managedZoneResource.privateVisibilityConfig.networks.networkUrl
  • policy.networks.networkUrl
  • policyResource.networks.networkUrl
  • responsePolicy.networks.networkUrl
  • targetNetwork
Policy configuration
  • policy
  • policy.description
  • policy.fingerprint
  • policy.name
Resource identifiers
  • change.id
  • managedZoneResource.name
  • policyResource.name
  • project
  • responsePolicy.responsePolicyName
  • responsePolicyRule.dnsName
Routing policy configurations
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.failovers.healthCheckedTargets.internalLoadBalancers.region
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.geoPolicy.items.healthCheckedTargets.internalLoadBalancers.ipAddress
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.failovers.signatureRrdatas
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.wrrPolicy.items.rrdatas
TSIG key configuration
  • tsigKey
  • tsigKey.fingerprint
  • tsigKey.key
  • tsigKey.name
  • tsigKeyResource.key
  • tsigKeyResource.name

Data Boundary for Impact Level 2 (IL2)

Supported services

The following table lists the Cloud DNS APIs and versions that meet the requirements of Data Boundary for Impact Level 2 (IL2).

Service Version Status
dns.googleapis.com v1 SUPPORTED
dns.googleapis.com v1alpha2 SUPPORTED
dns.googleapis.com v1beta2 SUPPORTED
dns.googleapis.com v2 SUPPORTED
dns.googleapis.com v2beta1 SUPPORTED

Fields not intended for Sensitive data

The following table provides an illustrative list of field categories and specific fields that aren't suitable for sensitive information. To maintain compliance, avoid placing protected data in these fields. For a complete list, contact your Google Cloud representative.

Category Fields
Authentication and authorization
  • header.authorization
Client identifiers
  • header.abuse.metadata.clientIp
  • header.abuse.metadata.deviceIdHash
  • header.abuse.metadata.networkId
  • header.abuse.metadata.source
  • header.abuse.metadata.userAgent
  • header.abuse.metadata.userKey.id
DNS record set details
  • rrset.name
  • rrset.routingPolicy.geo.failovers.rrdatas
  • rrset.routingPolicy.geo.items.rrdatas
  • rrset.routingPolicy.wrr.items.rrdatas
  • rrset.rrdatas
  • rrset.type
GKE cluster information
  • policy.gkeClusters.gkeClusterName
  • policy.gkeClusters.internalGkeClusterHash
  • policyResource.gkeClusters.gkeClusterName
  • policyResource.gkeClusters.internalGkeClusterHash
  • responsePolicy.gkeClusters.gkeClusterName
  • responsePolicy.gkeClusters.internalGkeClusterHash
Managed zone configuration
  • managedZone
  • managedZone.description
  • managedZone.dnsName
  • managedZone.forwardingConfig.targetNameServers.ipv4Address
  • managedZone.forwardingConfig.targetNameServers.ipv6Address
  • managedZone.name
Network targeting
  • managedZone.privateVisibilityConfig.networks.networkUrl
  • managedZoneResource.privateVisibilityConfig.networks.networkUrl
  • policy.networks.networkUrl
  • policyResource.networks.networkUrl
  • responsePolicy.networks.networkUrl
  • targetNetwork
Policy configuration
  • policy
  • policy.description
  • policy.fingerprint
  • policy.name
Resource identifiers
  • change.id
  • managedZoneResource.name
  • policyResource.name
  • project
  • responsePolicy.responsePolicyName
  • responsePolicyRule.dnsName
Routing policy configurations
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.failovers.healthCheckedTargets.internalLoadBalancers.region
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.geoPolicy.items.healthCheckedTargets.internalLoadBalancers.ipAddress
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.failovers.signatureRrdatas
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.wrrPolicy.items.rrdatas
TSIG key configuration
  • tsigKey
  • tsigKey.fingerprint
  • tsigKey.key
  • tsigKey.name
  • tsigKeyResource.key
  • tsigKeyResource.name

Data Boundary for Impact Level 4 (IL4)

Supported services

The following table lists the Cloud DNS APIs and versions that meet the requirements of Data Boundary for Impact Level 4 (IL4).

Service Version Status
dns.googleapis.com v1 SUPPORTED
dns.googleapis.com v1alpha2 SUPPORTED
dns.googleapis.com v1beta2 SUPPORTED
dns.googleapis.com v2 SUPPORTED
dns.googleapis.com v2beta1 SUPPORTED

Fields not intended for Sensitive data

The following table provides an illustrative list of field categories and specific fields that aren't suitable for sensitive information. To maintain compliance, avoid placing protected data in these fields. For a complete list, contact your Google Cloud representative.

Category Fields
Authentication and authorization
  • header.authorization
Client identifiers
  • header.abuse.metadata.clientIp
  • header.abuse.metadata.deviceIdHash
  • header.abuse.metadata.networkId
  • header.abuse.metadata.source
  • header.abuse.metadata.userAgent
  • header.abuse.metadata.userKey.id
DNS record set details
  • rrset.name
  • rrset.routingPolicy.geo.failovers.rrdatas
  • rrset.routingPolicy.geo.items.rrdatas
  • rrset.routingPolicy.wrr.items.rrdatas
  • rrset.rrdatas
  • rrset.type
GKE cluster information
  • policy.gkeClusters.gkeClusterName
  • policy.gkeClusters.internalGkeClusterHash
  • policyResource.gkeClusters.gkeClusterName
  • policyResource.gkeClusters.internalGkeClusterHash
  • responsePolicy.gkeClusters.gkeClusterName
  • responsePolicy.gkeClusters.internalGkeClusterHash
Managed zone configuration
  • managedZone
  • managedZone.description
  • managedZone.dnsName
  • managedZone.forwardingConfig.targetNameServers.ipv4Address
  • managedZone.forwardingConfig.targetNameServers.ipv6Address
  • managedZone.name
Network targeting
  • managedZone.privateVisibilityConfig.networks.networkUrl
  • managedZoneResource.privateVisibilityConfig.networks.networkUrl
  • policy.networks.networkUrl
  • policyResource.networks.networkUrl
  • responsePolicy.networks.networkUrl
  • targetNetwork
Policy configuration
  • policy
  • policy.description
  • policy.fingerprint
  • policy.name
Resource identifiers
  • change.id
  • managedZoneResource.name
  • policyResource.name
  • project
  • responsePolicy.responsePolicyName
  • responsePolicyRule.dnsName
Routing policy configurations
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.failovers.healthCheckedTargets.internalLoadBalancers.region
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.geoPolicy.items.healthCheckedTargets.internalLoadBalancers.ipAddress
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.failovers.signatureRrdatas
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.wrrPolicy.items.rrdatas
TSIG key configuration
  • tsigKey
  • tsigKey.fingerprint
  • tsigKey.key
  • tsigKey.name
  • tsigKeyResource.key
  • tsigKeyResource.name

Data Boundary for Impact Level 5 (IL5)

Supported services

The following table lists the Cloud DNS APIs and versions that meet the requirements of Data Boundary for Impact Level 5 (IL5).

Service Version Status
dns.googleapis.com v1 SUPPORTED
dns.googleapis.com v1alpha2 SUPPORTED
dns.googleapis.com v1beta2 SUPPORTED
dns.googleapis.com v2 SUPPORTED
dns.googleapis.com v2beta1 SUPPORTED

Fields not intended for Sensitive data

The following table provides an illustrative list of field categories and specific fields that aren't suitable for sensitive information. To maintain compliance, avoid placing protected data in these fields. For a complete list, contact your Google Cloud representative.

Category Fields
Authentication and authorization
  • header.authorization
Client identifiers
  • header.abuse.metadata.clientIp
  • header.abuse.metadata.deviceIdHash
  • header.abuse.metadata.networkId
  • header.abuse.metadata.source
  • header.abuse.metadata.userAgent
  • header.abuse.metadata.userKey.id
DNS record set details
  • rrset.name
  • rrset.routingPolicy.geo.failovers.rrdatas
  • rrset.routingPolicy.geo.items.rrdatas
  • rrset.routingPolicy.wrr.items.rrdatas
  • rrset.rrdatas
  • rrset.type
GKE cluster information
  • policy.gkeClusters.gkeClusterName
  • policy.gkeClusters.internalGkeClusterHash
  • policyResource.gkeClusters.gkeClusterName
  • policyResource.gkeClusters.internalGkeClusterHash
  • responsePolicy.gkeClusters.gkeClusterName
  • responsePolicy.gkeClusters.internalGkeClusterHash
Managed zone configuration
  • managedZone
  • managedZone.description
  • managedZone.dnsName
  • managedZone.forwardingConfig.targetNameServers.ipv4Address
  • managedZone.forwardingConfig.targetNameServers.ipv6Address
  • managedZone.name
Network targeting
  • managedZone.privateVisibilityConfig.networks.networkUrl
  • managedZoneResource.privateVisibilityConfig.networks.networkUrl
  • policy.networks.networkUrl
  • policyResource.networks.networkUrl
  • responsePolicy.networks.networkUrl
  • targetNetwork
Policy configuration
  • policy
  • policy.description
  • policy.fingerprint
  • policy.name
Resource identifiers
  • change.id
  • managedZoneResource.name
  • policyResource.name
  • project
  • responsePolicy.responsePolicyName
  • responsePolicyRule.dnsName
Routing policy configurations
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.failovers.healthCheckedTargets.internalLoadBalancers.region
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.geoPolicy.items.healthCheckedTargets.internalLoadBalancers.ipAddress
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.failovers.signatureRrdatas
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.wrrPolicy.items.rrdatas
TSIG key configuration
  • tsigKey
  • tsigKey.fingerprint
  • tsigKey.key
  • tsigKey.name
  • tsigKeyResource.key
  • tsigKeyResource.name

EU Data Boundary with Access Justifications

Supported services

The following table lists the Cloud DNS APIs and versions that meet the requirements of EU Data Boundary with Access Justifications.

Service Version Status
dns.googleapis.com v1 SUPPORTED
dns.googleapis.com v1alpha2 SUPPORTED
dns.googleapis.com v1beta2 SUPPORTED
dns.googleapis.com v2 SUPPORTED
dns.googleapis.com v2beta1 SUPPORTED

Fields not intended for Sensitive data

The following table provides an illustrative list of field categories and specific fields that aren't suitable for sensitive information. To maintain compliance, avoid placing protected data in these fields. For a complete list, contact your Google Cloud representative.

Category Fields
Authentication and authorization
  • header.authorization
Client identifiers
  • header.abuse.metadata.clientIp
  • header.abuse.metadata.deviceIdHash
  • header.abuse.metadata.networkId
  • header.abuse.metadata.source
  • header.abuse.metadata.userAgent
  • header.abuse.metadata.userKey.id
DNS record set details
  • rrset.name
  • rrset.routingPolicy.geo.failovers.rrdatas
  • rrset.routingPolicy.geo.items.rrdatas
  • rrset.routingPolicy.wrr.items.rrdatas
  • rrset.rrdatas
  • rrset.type
GKE cluster information
  • policy.gkeClusters.gkeClusterName
  • policy.gkeClusters.internalGkeClusterHash
  • policyResource.gkeClusters.gkeClusterName
  • policyResource.gkeClusters.internalGkeClusterHash
  • responsePolicy.gkeClusters.gkeClusterName
  • responsePolicy.gkeClusters.internalGkeClusterHash
Managed zone configuration
  • managedZone
  • managedZone.description
  • managedZone.dnsName
  • managedZone.forwardingConfig.targetNameServers.ipv4Address
  • managedZone.forwardingConfig.targetNameServers.ipv6Address
  • managedZone.name
Network targeting
  • managedZone.privateVisibilityConfig.networks.networkUrl
  • managedZoneResource.privateVisibilityConfig.networks.networkUrl
  • policy.networks.networkUrl
  • policyResource.networks.networkUrl
  • responsePolicy.networks.networkUrl
  • targetNetwork
Policy configuration
  • policy
  • policy.description
  • policy.fingerprint
  • policy.name
Resource identifiers
  • change.id
  • managedZoneResource.name
  • policyResource.name
  • project
  • responsePolicy.responsePolicyName
  • responsePolicyRule.dnsName
Routing policy configurations
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.failovers.healthCheckedTargets.internalLoadBalancers.region
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.geoPolicy.items.healthCheckedTargets.internalLoadBalancers.ipAddress
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.failovers.signatureRrdatas
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.wrrPolicy.items.rrdatas
TSIG key configuration
  • tsigKey
  • tsigKey.fingerprint
  • tsigKey.key
  • tsigKey.name
  • tsigKeyResource.key
  • tsigKeyResource.name

Kingdom of Saudi Arabia Data Boundary with Access Justifications

Supported services

The following table lists the Cloud DNS APIs and versions that meet the requirements of Kingdom of Saudi Arabia Data Boundary with Access Justifications.

Service Version Status
dns.googleapis.com v1 SUPPORTED
dns.googleapis.com v1alpha2 SUPPORTED
dns.googleapis.com v1beta2 SUPPORTED
dns.googleapis.com v2 SUPPORTED
dns.googleapis.com v2beta1 SUPPORTED

Fields not intended for Sensitive data

The following table provides an illustrative list of field categories and specific fields that aren't suitable for sensitive information. To maintain compliance, avoid placing protected data in these fields. For a complete list, contact your Google Cloud representative.

Category Fields
Authentication and authorization
  • header.authorization
Client identifiers
  • header.abuse.metadata.clientIp
  • header.abuse.metadata.deviceIdHash
  • header.abuse.metadata.networkId
  • header.abuse.metadata.source
  • header.abuse.metadata.userAgent
  • header.abuse.metadata.userKey.id
DNS record set details
  • rrset.name
  • rrset.routingPolicy.geo.failovers.rrdatas
  • rrset.routingPolicy.geo.items.rrdatas
  • rrset.routingPolicy.wrr.items.rrdatas
  • rrset.rrdatas
  • rrset.type
GKE cluster information
  • policy.gkeClusters.gkeClusterName
  • policy.gkeClusters.internalGkeClusterHash
  • policyResource.gkeClusters.gkeClusterName
  • policyResource.gkeClusters.internalGkeClusterHash
  • responsePolicy.gkeClusters.gkeClusterName
  • responsePolicy.gkeClusters.internalGkeClusterHash
Managed zone configuration
  • managedZone
  • managedZone.description
  • managedZone.dnsName
  • managedZone.forwardingConfig.targetNameServers.ipv4Address
  • managedZone.forwardingConfig.targetNameServers.ipv6Address
  • managedZone.name
Network targeting
  • managedZone.privateVisibilityConfig.networks.networkUrl
  • managedZoneResource.privateVisibilityConfig.networks.networkUrl
  • policy.networks.networkUrl
  • policyResource.networks.networkUrl
  • responsePolicy.networks.networkUrl
  • targetNetwork
Policy configuration
  • policy
  • policy.description
  • policy.fingerprint
  • policy.name
Resource identifiers
  • change.id
  • managedZoneResource.name
  • policyResource.name
  • project
  • responsePolicy.responsePolicyName
  • responsePolicyRule.dnsName
Routing policy configurations
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.failovers.healthCheckedTargets.internalLoadBalancers.region
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.geoPolicy.items.healthCheckedTargets.internalLoadBalancers.ipAddress
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.failovers.signatureRrdatas
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.wrrPolicy.items.rrdatas
TSIG key configuration
  • tsigKey
  • tsigKey.fingerprint
  • tsigKey.key
  • tsigKey.name
  • tsigKeyResource.key
  • tsigKeyResource.name

Sovereign Controls Advanced KSA CNTXT

Supported services

The following table lists the Cloud DNS APIs and versions that meet the requirements of Sovereign Controls Advanced KSA CNTXT.

Service Version Status
dns.googleapis.com v1 SUPPORTED
dns.googleapis.com v1alpha2 SUPPORTED
dns.googleapis.com v1beta2 SUPPORTED
dns.googleapis.com v2 SUPPORTED
dns.googleapis.com v2beta1 SUPPORTED

Fields not intended for Sensitive data

The following table provides an illustrative list of field categories and specific fields that aren't suitable for sensitive information. To maintain compliance, avoid placing protected data in these fields. For a complete list, contact your Google Cloud representative.

Category Fields
Authentication and authorization
  • header.authorization
Client identifiers
  • header.abuse.metadata.clientIp
  • header.abuse.metadata.deviceIdHash
  • header.abuse.metadata.networkId
  • header.abuse.metadata.source
  • header.abuse.metadata.userAgent
  • header.abuse.metadata.userKey.id
DNS record set details
  • rrset.name
  • rrset.routingPolicy.geo.failovers.rrdatas
  • rrset.routingPolicy.geo.items.rrdatas
  • rrset.routingPolicy.wrr.items.rrdatas
  • rrset.rrdatas
  • rrset.type
GKE cluster information
  • policy.gkeClusters.gkeClusterName
  • policy.gkeClusters.internalGkeClusterHash
  • policyResource.gkeClusters.gkeClusterName
  • policyResource.gkeClusters.internalGkeClusterHash
  • responsePolicy.gkeClusters.gkeClusterName
  • responsePolicy.gkeClusters.internalGkeClusterHash
Managed zone configuration
  • managedZone
  • managedZone.description
  • managedZone.dnsName
  • managedZone.forwardingConfig.targetNameServers.ipv4Address
  • managedZone.forwardingConfig.targetNameServers.ipv6Address
  • managedZone.name
Network targeting
  • managedZone.privateVisibilityConfig.networks.networkUrl
  • managedZoneResource.privateVisibilityConfig.networks.networkUrl
  • policy.networks.networkUrl
  • policyResource.networks.networkUrl
  • responsePolicy.networks.networkUrl
  • targetNetwork
Policy configuration
  • policy
  • policy.description
  • policy.fingerprint
  • policy.name
Resource identifiers
  • change.id
  • managedZoneResource.name
  • policyResource.name
  • project
  • responsePolicy.responsePolicyName
  • responsePolicyRule.dnsName
Routing policy configurations
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.failovers.healthCheckedTargets.internalLoadBalancers.region
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.geoPolicy.items.healthCheckedTargets.internalLoadBalancers.ipAddress
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.failovers.signatureRrdatas
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.wrrPolicy.items.rrdatas
TSIG key configuration
  • tsigKey
  • tsigKey.fingerprint
  • tsigKey.key
  • tsigKey.name
  • tsigKeyResource.key
  • tsigKeyResource.name

Sovereign Controls Foundation KSA CNTXT

Supported services

The following table lists the Cloud DNS APIs and versions that meet the requirements of Sovereign Controls Foundation KSA CNTXT.

Service Version Status
dns.googleapis.com v1 SUPPORTED
dns.googleapis.com v1alpha2 SUPPORTED
dns.googleapis.com v1beta2 SUPPORTED
dns.googleapis.com v2 SUPPORTED
dns.googleapis.com v2beta1 SUPPORTED

Fields not intended for Sensitive data

The following table provides an illustrative list of field categories and specific fields that aren't suitable for sensitive information. To maintain compliance, avoid placing protected data in these fields. For a complete list, contact your Google Cloud representative.

Category Fields
Authentication and authorization
  • header.authorization
Client identifiers
  • header.abuse.metadata.clientIp
  • header.abuse.metadata.deviceIdHash
  • header.abuse.metadata.networkId
  • header.abuse.metadata.source
  • header.abuse.metadata.userAgent
  • header.abuse.metadata.userKey.id
DNS record set details
  • rrset.name
  • rrset.routingPolicy.geo.failovers.rrdatas
  • rrset.routingPolicy.geo.items.rrdatas
  • rrset.routingPolicy.wrr.items.rrdatas
  • rrset.rrdatas
  • rrset.type
GKE cluster information
  • policy.gkeClusters.gkeClusterName
  • policy.gkeClusters.internalGkeClusterHash
  • policyResource.gkeClusters.gkeClusterName
  • policyResource.gkeClusters.internalGkeClusterHash
  • responsePolicy.gkeClusters.gkeClusterName
  • responsePolicy.gkeClusters.internalGkeClusterHash
Managed zone configuration
  • managedZone
  • managedZone.description
  • managedZone.dnsName
  • managedZone.forwardingConfig.targetNameServers.ipv4Address
  • managedZone.forwardingConfig.targetNameServers.ipv6Address
  • managedZone.name
Network targeting
  • managedZone.privateVisibilityConfig.networks.networkUrl
  • managedZoneResource.privateVisibilityConfig.networks.networkUrl
  • policy.networks.networkUrl
  • policyResource.networks.networkUrl
  • responsePolicy.networks.networkUrl
  • targetNetwork
Policy configuration
  • policy
  • policy.description
  • policy.fingerprint
  • policy.name
Resource identifiers
  • change.id
  • managedZoneResource.name
  • policyResource.name
  • project
  • responsePolicy.responsePolicyName
  • responsePolicyRule.dnsName
Routing policy configurations
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.failovers.healthCheckedTargets.internalLoadBalancers.region
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.geoPolicy.items.healthCheckedTargets.internalLoadBalancers.ipAddress
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.failovers.signatureRrdatas
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.wrrPolicy.items.rrdatas
TSIG key configuration
  • tsigKey
  • tsigKey.fingerprint
  • tsigKey.key
  • tsigKey.name
  • tsigKeyResource.key
  • tsigKeyResource.name

Sovereign Controls by Indra / Minsait

Supported services

The following table lists the Cloud DNS APIs and versions that meet the requirements of Sovereign Controls by Indra / Minsait.

Service Version Status
dns.googleapis.com v1 SUPPORTED
dns.googleapis.com v1alpha2 SUPPORTED
dns.googleapis.com v1beta2 SUPPORTED
dns.googleapis.com v2 SUPPORTED
dns.googleapis.com v2beta1 SUPPORTED

Fields not intended for Sensitive data

The following table provides an illustrative list of field categories and specific fields that aren't suitable for sensitive information. To maintain compliance, avoid placing protected data in these fields. For a complete list, contact your Google Cloud representative.

Category Fields
Authentication and authorization
  • header.authorization
Client identifiers
  • header.abuse.metadata.clientIp
  • header.abuse.metadata.deviceIdHash
  • header.abuse.metadata.networkId
  • header.abuse.metadata.source
  • header.abuse.metadata.userAgent
  • header.abuse.metadata.userKey.id
DNS record set details
  • rrset.name
  • rrset.routingPolicy.geo.failovers.rrdatas
  • rrset.routingPolicy.geo.items.rrdatas
  • rrset.routingPolicy.wrr.items.rrdatas
  • rrset.rrdatas
  • rrset.type
GKE cluster information
  • policy.gkeClusters.gkeClusterName
  • policy.gkeClusters.internalGkeClusterHash
  • policyResource.gkeClusters.gkeClusterName
  • policyResource.gkeClusters.internalGkeClusterHash
  • responsePolicy.gkeClusters.gkeClusterName
  • responsePolicy.gkeClusters.internalGkeClusterHash
Managed zone configuration
  • managedZone
  • managedZone.description
  • managedZone.dnsName
  • managedZone.forwardingConfig.targetNameServers.ipv4Address
  • managedZone.forwardingConfig.targetNameServers.ipv6Address
  • managedZone.name
Network targeting
  • managedZone.privateVisibilityConfig.networks.networkUrl
  • managedZoneResource.privateVisibilityConfig.networks.networkUrl
  • policy.networks.networkUrl
  • policyResource.networks.networkUrl
  • responsePolicy.networks.networkUrl
  • targetNetwork
Policy configuration
  • policy
  • policy.description
  • policy.fingerprint
  • policy.name
Resource identifiers
  • change.id
  • managedZoneResource.name
  • policyResource.name
  • project
  • responsePolicy.responsePolicyName
  • responsePolicyRule.dnsName
Routing policy configurations
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.failovers.healthCheckedTargets.internalLoadBalancers.region
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.geoPolicy.items.healthCheckedTargets.internalLoadBalancers.ipAddress
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.failovers.signatureRrdatas
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.wrrPolicy.items.rrdatas
TSIG key configuration
  • tsigKey
  • tsigKey.fingerprint
  • tsigKey.key
  • tsigKey.name
  • tsigKeyResource.key
  • tsigKeyResource.name

Sovereign Controls by PSN (TIM)

Supported services

The following table lists the Cloud DNS APIs and versions that meet the requirements of Sovereign Controls by PSN (TIM).

Service Version Status
dns.googleapis.com v1 SUPPORTED
dns.googleapis.com v1alpha2 SUPPORTED
dns.googleapis.com v1beta2 SUPPORTED
dns.googleapis.com v2 SUPPORTED
dns.googleapis.com v2beta1 SUPPORTED

Fields not intended for Sensitive data

The following table provides an illustrative list of field categories and specific fields that aren't suitable for sensitive information. To maintain compliance, avoid placing protected data in these fields. For a complete list, contact your Google Cloud representative.

Category Fields
Authentication and authorization
  • header.authorization
Client identifiers
  • header.abuse.metadata.clientIp
  • header.abuse.metadata.deviceIdHash
  • header.abuse.metadata.networkId
  • header.abuse.metadata.source
  • header.abuse.metadata.userAgent
  • header.abuse.metadata.userKey.id
DNS record set details
  • rrset.name
  • rrset.routingPolicy.geo.failovers.rrdatas
  • rrset.routingPolicy.geo.items.rrdatas
  • rrset.routingPolicy.wrr.items.rrdatas
  • rrset.rrdatas
  • rrset.type
GKE cluster information
  • policy.gkeClusters.gkeClusterName
  • policy.gkeClusters.internalGkeClusterHash
  • policyResource.gkeClusters.gkeClusterName
  • policyResource.gkeClusters.internalGkeClusterHash
  • responsePolicy.gkeClusters.gkeClusterName
  • responsePolicy.gkeClusters.internalGkeClusterHash
Managed zone configuration
  • managedZone
  • managedZone.description
  • managedZone.dnsName
  • managedZone.forwardingConfig.targetNameServers.ipv4Address
  • managedZone.forwardingConfig.targetNameServers.ipv6Address
  • managedZone.name
Network targeting
  • managedZone.privateVisibilityConfig.networks.networkUrl
  • managedZoneResource.privateVisibilityConfig.networks.networkUrl
  • policy.networks.networkUrl
  • policyResource.networks.networkUrl
  • responsePolicy.networks.networkUrl
  • targetNetwork
Policy configuration
  • policy
  • policy.description
  • policy.fingerprint
  • policy.name
Resource identifiers
  • change.id
  • managedZoneResource.name
  • policyResource.name
  • project
  • responsePolicy.responsePolicyName
  • responsePolicyRule.dnsName
Routing policy configurations
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.failovers.healthCheckedTargets.internalLoadBalancers.region
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.geoPolicy.items.healthCheckedTargets.internalLoadBalancers.ipAddress
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.failovers.signatureRrdatas
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.wrrPolicy.items.rrdatas
TSIG key configuration
  • tsigKey
  • tsigKey.fingerprint
  • tsigKey.key
  • tsigKey.name
  • tsigKeyResource.key
  • tsigKeyResource.name

US Data Boundary for Healthcare and Life Sciences

Supported services

The following table lists the Cloud DNS APIs and versions that meet the requirements of US Data Boundary for Healthcare and Life Sciences.

Service Version Status
dns.googleapis.com v1 SUPPORTED
dns.googleapis.com v1alpha2 SUPPORTED
dns.googleapis.com v1beta2 SUPPORTED
dns.googleapis.com v2 SUPPORTED
dns.googleapis.com v2beta1 SUPPORTED

Fields not intended for Sensitive data

The following table provides an illustrative list of field categories and specific fields that aren't suitable for sensitive information. To maintain compliance, avoid placing protected data in these fields. For a complete list, contact your Google Cloud representative.

Category Fields
Authentication and authorization
  • header.authorization
Client identifiers
  • header.abuse.metadata.clientIp
  • header.abuse.metadata.deviceIdHash
  • header.abuse.metadata.networkId
  • header.abuse.metadata.source
  • header.abuse.metadata.userAgent
  • header.abuse.metadata.userKey.id
DNS record set details
  • rrset.name
  • rrset.routingPolicy.geo.failovers.rrdatas
  • rrset.routingPolicy.geo.items.rrdatas
  • rrset.routingPolicy.wrr.items.rrdatas
  • rrset.rrdatas
  • rrset.type
GKE cluster information
  • policy.gkeClusters.gkeClusterName
  • policy.gkeClusters.internalGkeClusterHash
  • policyResource.gkeClusters.gkeClusterName
  • policyResource.gkeClusters.internalGkeClusterHash
  • responsePolicy.gkeClusters.gkeClusterName
  • responsePolicy.gkeClusters.internalGkeClusterHash
Managed zone configuration
  • managedZone
  • managedZone.description
  • managedZone.dnsName
  • managedZone.forwardingConfig.targetNameServers.ipv4Address
  • managedZone.forwardingConfig.targetNameServers.ipv6Address
  • managedZone.name
Network targeting
  • managedZone.privateVisibilityConfig.networks.networkUrl
  • managedZoneResource.privateVisibilityConfig.networks.networkUrl
  • policy.networks.networkUrl
  • policyResource.networks.networkUrl
  • responsePolicy.networks.networkUrl
  • targetNetwork
Policy configuration
  • policy
  • policy.description
  • policy.fingerprint
  • policy.name
Resource identifiers
  • change.id
  • managedZoneResource.name
  • policyResource.name
  • project
  • responsePolicy.responsePolicyName
  • responsePolicyRule.dnsName
Routing policy configurations
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.failovers.healthCheckedTargets.internalLoadBalancers.region
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.geoPolicy.items.healthCheckedTargets.internalLoadBalancers.ipAddress
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.failovers.signatureRrdatas
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.wrrPolicy.items.rrdatas
TSIG key configuration
  • tsigKey
  • tsigKey.fingerprint
  • tsigKey.key
  • tsigKey.name
  • tsigKeyResource.key
  • tsigKeyResource.name

US Data Boundary for Healthcare and Life Sciences with Support

Supported services

The following table lists the Cloud DNS APIs and versions that meet the requirements of US Data Boundary for Healthcare and Life Sciences with Support.

Service Version Status
dns.googleapis.com v1 SUPPORTED
dns.googleapis.com v1alpha2 SUPPORTED
dns.googleapis.com v1beta2 SUPPORTED
dns.googleapis.com v2 SUPPORTED
dns.googleapis.com v2beta1 SUPPORTED

Fields not intended for Sensitive data

The following table provides an illustrative list of field categories and specific fields that aren't suitable for sensitive information. To maintain compliance, avoid placing protected data in these fields. For a complete list, contact your Google Cloud representative.

Category Fields
Authentication and authorization
  • header.authorization
Client identifiers
  • header.abuse.metadata.clientIp
  • header.abuse.metadata.deviceIdHash
  • header.abuse.metadata.networkId
  • header.abuse.metadata.source
  • header.abuse.metadata.userAgent
  • header.abuse.metadata.userKey.id
DNS record set details
  • rrset.name
  • rrset.routingPolicy.geo.failovers.rrdatas
  • rrset.routingPolicy.geo.items.rrdatas
  • rrset.routingPolicy.wrr.items.rrdatas
  • rrset.rrdatas
  • rrset.type
GKE cluster information
  • policy.gkeClusters.gkeClusterName
  • policy.gkeClusters.internalGkeClusterHash
  • policyResource.gkeClusters.gkeClusterName
  • policyResource.gkeClusters.internalGkeClusterHash
  • responsePolicy.gkeClusters.gkeClusterName
  • responsePolicy.gkeClusters.internalGkeClusterHash
Managed zone configuration
  • managedZone
  • managedZone.description
  • managedZone.dnsName
  • managedZone.forwardingConfig.targetNameServers.ipv4Address
  • managedZone.forwardingConfig.targetNameServers.ipv6Address
  • managedZone.name
Network targeting
  • managedZone.privateVisibilityConfig.networks.networkUrl
  • managedZoneResource.privateVisibilityConfig.networks.networkUrl
  • policy.networks.networkUrl
  • policyResource.networks.networkUrl
  • responsePolicy.networks.networkUrl
  • targetNetwork
Policy configuration
  • policy
  • policy.description
  • policy.fingerprint
  • policy.name
Resource identifiers
  • change.id
  • managedZoneResource.name
  • policyResource.name
  • project
  • responsePolicy.responsePolicyName
  • responsePolicyRule.dnsName
Routing policy configurations
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.failovers.healthCheckedTargets.internalLoadBalancers.region
  • responsePolicyRule.localData.localDatas.routingPolicy.geo.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.geoPolicy.items.healthCheckedTargets.internalLoadBalancers.ipAddress
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.failovers.signatureRrdatas
  • responsePolicyRule.localData.localDatas.routingPolicy.primaryBackup.backupGeoTargets.items.healthCheckedTargets.internalLoadBalancers.port
  • responsePolicyRule.localData.localDatas.routingPolicy.wrrPolicy.items.rrdatas
TSIG key configuration
  • tsigKey
  • tsigKey.fingerprint
  • tsigKey.key
  • tsigKey.name
  • tsigKeyResource.key
  • tsigKeyResource.name

What's next