Cloud DNS

Connect

Cloud DNS sits at the root of the emulator’s address: requests go to $VERA_ENDPOINT/dns/v1/. For gcloud, add this override to the shared setup:

export CLOUDSDK_API_ENDPOINT_OVERRIDES_DNS="$VERA_ENDPOINT/"

Example

Create a public zone, add an A record and list the zone’s records. Every zone also gets the apex NS and SOA records Cloud DNS creates.

gcloud

gcloud dns managed-zones create example-zone \
  --dns-name=example.net. --description="Example zone"
gcloud dns record-sets create www.example.net. \
  --zone=example-zone --type=A --ttl=300 --rrdatas=192.0.2.10
gcloud dns record-sets list --zone=example-zone --format=json

The last command prints:

Output

[
  {
    "kind": "dns#resourceRecordSet",
    "name": "example.net.",
    "rrdatas": [
      "ns-cloud-a1.googledomains.com.",
      "ns-cloud-a2.googledomains.com.",
      "ns-cloud-a3.googledomains.com.",
      "ns-cloud-a4.googledomains.com."
    ],
    "ttl": 21600,
    "type": "NS"
  },
  {
    "kind": "dns#resourceRecordSet",
    "name": "example.net.",
    "rrdatas": [
      "ns-cloud-a1.googledomains.com. cloud-dns-hostmaster.google.com. 1 21600 3600 259200 300"
    ],
    "ttl": 21600,
    "type": "SOA"
  },
  {
    "kind": "dns#resourceRecordSet",
    "name": "www.example.net.",
    "rrdatas": ["192.0.2.10"],
    "ttl": 300,
    "type": "A"
  }
]

To clean up:

gcloud dns record-sets delete www.example.net. --zone=example-zone --type=A
gcloud dns managed-zones delete example-zone

REST

curl -X POST "$VERA_ENDPOINT/dns/v1/projects/example-project/managedZones" \
  -H "Content-Type: application/json" \
  -d '{"name":"example-zone","dnsName":"example.net.","description":"Example zone"}'

curl -X POST "$VERA_ENDPOINT/dns/v1/projects/example-project/managedZones/example-zone/rrsets" \
  -H "Content-Type: application/json" \
  -d '{"name":"www.example.net.","type":"A","ttl":300,"rrdatas":["192.0.2.10"]}'

curl "$VERA_ENDPOINT/dns/v1/projects/example-project/managedZones/example-zone/rrsets"

The first request returns the new zone. Its id and creationTime differ on every run.

Response

{
  "cloudLoggingConfig": { "kind": "dns#managedZoneCloudLoggingConfig" },
  "creationTime": "2026-11-02T20:16:32.614Z",
  "description": "Example zone",
  "dnsName": "example.net.",
  "id": "8702057787155687305",
  "kind": "dns#managedZone",
  "name": "example-zone",
  "nameServers": [
    "ns-cloud-a1.googledomains.com.",
    "ns-cloud-a2.googledomains.com.",
    "ns-cloud-a3.googledomains.com.",
    "ns-cloud-a4.googledomains.com."
  ],
  "visibility": "public"
}

Supported features

• Managed zones, public and private, created with their apex NS and SOA records.
• Record sets, directly or through atomic changes, with record data checked for each type and routing policies validated.
• Private zones visible to Compute Engine VPC networks, with forwarding, peering and Service Directory bindings checked.
• Server and response policies, and response policy rules, with one of each policy per VPC network.
• DNSSEC key metadata for public zones.
• Change history and zone operations to read and list.
• IAM policies on managed zones.
• v1beta2 and v1alpha2 requests.

Limitations

• No DNS server. Nothing answers DNS queries: there’s no resolution, forwarding, peering traffic, DNS64 or routing-policy execution.
• Inbound forwarding on a server policy doesn’t reserve the resolver addresses Google Cloud lists in Compute Engine.
• DNSSEC keys are metadata. Nothing is signed, and one of a zone’s two default keys is listed without digests.
• No Cloud DNS v2. v2 requests answer 501 Not Implemented, except the global managed-zone getIamPolicy.
• Lenient full updates. A zone PUT that omits id, nameServers or creationTime is accepted. Google Cloud rejects it.
• IAM isn’t enforced. Requests aren’t authorized against zone policies. Setting a policy does check that its roles are supported and that modeled members exist.
• Deleting a network leaves DNS alone: zones and policies keep the reference.
• Quota errors haven’t been compared with Google Cloud’s.
• Operations finish immediately, and name emulator@vera.local as their user.

API coverage

Measured 2 November 2026 against recorded Google Cloud responses. What the statuses mean

managedZones

9 methods · 1 partial · 1 not tested

Method	Status	Notes
create	Supported	Private zones need an existing VPC network.
get	Supported	Accepts the zone's name or numeric ID.
list	Supported
patch	Supported	name, dnsName and visibility can't change.
update	Partial	Accepts a PUT that omits id, nameServers or creationTime. Google Cloud rejects it.
delete	Supported	Refused while the zone has records beyond its apex NS and SOA.
getIamPolicy	Supported
setIamPolicy	Supported
testIamPermissions	Not tested

resourceRecordSets

5 methods

Method	Status	Notes
create	Supported	Record data is checked per record type.
get	Supported
list	Supported	Supports the name=has_suffix(...) filter.
patch	Supported
delete	Supported

changes

3 methods

Method	Status	Notes
create	Supported	Atomic. Reports pending, then reads back as done.
get	Supported
list	Supported

managedZoneOperations

2 methods

Method	Status	Notes
get	Supported	Operations finish immediately.
list	Supported

dnsKeys

2 methods · 1 partial

Method	Status	Notes
get	Supported	Key metadata only.
list	Partial	One of the zone's two default keys has no digests.

policies

6 methods

Method	Status	Notes
create	Supported	One server policy per VPC network.
get	Supported
list	Supported
patch	Supported
update	Supported
delete	Supported	Refused while the policy is bound to networks.

responsePolicies

6 methods

Method	Status	Notes
create	Supported	One response policy per VPC network or GKE cluster.
get	Supported
list	Supported
patch	Supported
update	Supported
delete	Supported	Refused while the policy is bound to networks.

responsePolicyRules

6 methods · 1 not tested

Method	Status	Notes
create	Supported	Takes behavior or localData, not both.
get	Supported
list	Supported
patch	Not tested
update	Supported
delete	Supported

projects

1 method

Method	Status	Notes
get	Supported	Returns the project's default quotas.