Starting January 5, 2027, Cloud DNS will disable full responses to DNS queries of type ANY (QTYPE=ANY) in public authoritative zones.

Starting January 5, 2027, Cloud DNS will disable full responses to DNS queries of type ANY (QTYPE=ANY) in public authoritative zones. Instead, a single resource record will return for ANY queries, chosen from the existing resource record sets that match the query.

Standard traffic from web browsers, applications, and API traffic query specific record types directly and are therefore unaffected with no action required.

However, certain legacy scripts, automated health checkers, debugging commands (for example, dig example.com ANY), or custom third-party monitoring systems that explicitly query ANY records will receive the first available record instead of a full zone inventory. You must complete the following configuration updates before January 5, 2027:

• Identify legacy queries: Review internal tools, deployment scripts, or third-party DNS monitoring configurations for commands or API calls that request the ANY record type. Cloud DNS logs in Cloud Logging can be helpful with this.
• Transition to specific queries: Update the tools to query the specific, individual record types they require (for example, querying for A, AAAA, MX, or TXT records separately).
• Retrieve full zone records: If you use ANY queries to retrieve all records in a zone, use the Cloud DNS REST API (resourceRecordSets.list), the gcloud CLI (gcloud dns record-sets list), or the Google Cloud Console instead.

Risks associated with not making these changes include the following:

• False monitoring alarms: Automated uptime or DNS monitoring tools checking ANY responses may misinterpret the new response as a system failure and trigger false alerts.
• Broken automation pipelines: Internal deployment or CI/CD scripts that rely on parsing a full zone dump with an ANY query will fail to retrieve the expected data payload and may crash.
• Disrupted IT diagnostics: Network administrators running manual legacy troubleshooting commands will no longer see a quick summary of all domain records, which could delay active network incident diagnostics.