---
title: Cloud DNS DNSSEC should use a secure algorithm other than RSASHA1
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Cloud DNS DNSSEC should use a secure
  algorithm other than RSASHA1
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Cloud DNS DNSSEC should use a secure algorithm other than RSASHA1
 
## Description{% #description %}

The DNSSEC key-signing key (KSK) of a Cloud DNS managed zone should use a strong, recommended algorithm such as RSASHA256, RSASHA512, ECDSAP256SHA256, or ECDSAP384SHA384 instead of RSASHA1. The rule evaluates every zone that has DNSSEC key specs, including zones where DNSSEC is off, and fails a zone when its key-signing key uses RSASHA1. A zone with no key-signing key spec, or with a key spec that has no algorithm or key type, is also reported as noncompliant. Zones without DNSSEC key specs are not evaluated.

**Note:** Google has removed RSASHA1 from general use. A project can only use it after Google allows it on a per-project basis, which requires a Google Cloud support contract.

## Remediation{% #remediation %}

DNSSEC signing settings can only be changed while DNSSEC is off.

1. Turn off DNSSEC:

   ```shell
   gcloud dns managed-zones update ZONE_NAME --dnssec-state off
   ```

1. Turn DNSSEC back on with a secure key-signing algorithm:

   ```shell
   gcloud dns managed-zones update ZONE_NAME \
     --dnssec-state on \
     --ksk-algorithm KSK_ALGORITHM \
     --ksk-key-length KSK_KEY_LENGTH \
     --zsk-algorithm ZSK_ALGORITHM \
     --zsk-key-length ZSK_KEY_LENGTH \
     --denial-of-existence DENIAL_OF_EXISTENCE
   ```

For more information, see [Use advanced signing options](https://docs.cloud.google.com/dns/docs/dnssec-advanced#advanced-signing-options).

## References{% #references %}

- [Use advanced signing options](https://docs.cloud.google.com/dns/docs/dnssec-advanced#advanced-signing-options)