Starting January 5, 2027, CNAME chasing behavior will change so that Cloud DNS follows CNAME chains between public and private zones.

Starting January 5, 2027, CNAME chasing behavior will change so that Cloud DNS follows CNAME chains between public and private zones. If your private zones or response policies have overlapping domain names with public CNAME targets, queries might resolve to unintended internal IP addresses or return resolution errors.

The following table outlines the current and updated behaviors.

Source of CNAME answer · Current behavior (until January 5, 2027) · New behavior (starting January 5, 2027)

Cloud DNS public zone · Subsequent queries search only public DNS zones and internal DNS. Private zones, forwarding zones, and response policies are ignored. · Subsequent queries follow the complete VPC name resolution order: response policies, private zones, forwarding or peering zones, internal DNS, and public zones.

Cloud DNS private zone · Subsequent queries search only authorized private zones. Public DNS zones are ignored. · Subsequent queries follow the complete VPC name resolution order. If the target isn't found in authorized private zones, Cloud DNS queries public DNS zones.

Cloud DNS response policy zone · Cloud DNS systems don't perform queries for CNAME answers received from response policy local data rules. · Subsequent queries follow the complete VPC name resolution order. If the target isn't found in response policies or private zones, Cloud DNS queries public DNS zones.

Review your CNAME chasing needs before January 5, 2027. Test your DNS query paths using dig or nslookup to identify CNAME chasing scenarios.

• Look for private-to-public CNAME chasing scenarios: Look for CNAME answers from response policies or private zones that don't match any response policy or record in a private zone. Previously, these queries resulted in a NXDOMAIN answer but after January 5, 2027, these scenarios might match a record in a public zone or continue to be NXDOMAIN responses.
• Look for public-to-private CNAME chasing scenarios: Look for CNAME answers from public zones that don't match any record in a public zone. Previously, these CNAME chasing scenarios would have resulted in a NXDOMAIN response. After January 5, 2027, these scenarios might match a response policy or record in a private zone or continue to be NXDOMAIN responses if the private zone doesn't have the record.
• For CNAME chasing scenarios under your control: As best practice, configure matching time-to-live (TTL) values for all records in the CNAME chain.