Google Cloud DNS

Last updated: 2026-06-22

This folder stores read-only inventory snapshots and notes for Google Cloud DNS.

The service account JSON key is not stored here; keep it under:

tools/google-cloud-dns/.secrets/codex-cloud-dns.json

Capture Inventory

After placing the JSON key, protect it:

powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\google-cloud-dns\Protect-GoogleCloudDnsCredential.ps1

Then capture the current Cloud DNS zones and records:

powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\google-cloud-dns\Capture-GoogleCloudDnsInventory.ps1

Snapshots are written to:

google-cloud-dns/inventory/snapshots/

The current reviewed recommendation has been applied: use explicit public

service records instead of a broad wildcard. Re-check the intended shape:

powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\google-cloud-dns\Set-GoogleCloudDnsRecommendedRecords.ps1

Re-apply/enforce the change if drift is found:

powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\google-cloud-dns\Set-GoogleCloudDnsRecommendedRecords.ps1 -Apply

The script can be used to add/normalize explicit service CNAMEs such as:

Start with the DNS Reader role for safe inventory capture. Upgrade to

DNS Administrator only when we are ready to apply record changes.

DNSSEC was reviewed on 2026-06-13. The ravick5.com. public managed zone is

currently unsigned:

dnssecConfig.state: off

Recommendation: enable DNSSEC, but only as a coordinated DNS change that also

publishes Google Cloud DNS DS records at the domain registrar.

Runbook:

google-cloud-dns/DNSSEC_PLAN.md

Reconciliation note from 2026-06-22: latest Cloud DNS snapshot is

google-cloud-dns/inventory/snapshots/20260621-113009; record shape still uses

explicit service records rather than a wildcard.

Latest reviewed snapshot:

google-cloud-dns/inventory/snapshots/20260621-113009

Observed managed zone:

Project: ravick5-217115
Zone: ravick5
DNS name: ravick5.com.
Visibility: public

Current records of note:

DNS record presence does not by itself mean the matching application route is

approved or hardened. Public exposure state is tracked in

diagrams/PUBLIC_EXPOSURE.md; Audiobookshelf and reading app access remain

review-before-use items.

Change applied on 2026-05-21:

Change applied on 2026-05-25:

Change applied on 2026-05-25:

This keeps public service DNS intentional instead of pointing every possible

subdomain at the home public IP.