Cloud DNS Zone
Does ZopNight manage Cloud DNS Zone?
Cloud DNS charges a small fixed fee per managed zone per month plus query volume, so one zone is trivial and 200 forgotten zones are a habit worth breaking. ZopNight inventories every zone via Cloud Asset Inventory for topology completeness and flags zones whose records point at deleted resources.
Rules that fire on Cloud DNS Zone
No active rule family targets Cloud DNS Zone today. Rules that used to are retired, and retired rules publish no pages and fire no findings. Scheduling and permissions coverage are unaffected.
A Cloud DNS managed zone hosts DNS records for a domain, billed a small fixed fee per zone plus query volume. Zones for retired projects and domains linger easily.
Zone fees plus query volume
Cloud DNS billing has two small parts: a fixed monthly fee per managed zone, and a charge on the queries that zone answers. Neither amount turns heads on its own, which is precisely how DNS zones become the classic linger-forever resource. A zone created for a hackathon domain, a per-environment subdomain, or an acquired product keeps its monthly fee running years after the last record mattered, and because the number is small nobody ever owns deleting it. At organizational scale the per-zone fee multiplies quietly across every project.
Stale zones as a hygiene signal
ZopDev inventories DNS zones via Cloud Asset Inventory for topology completeness and flags zones pointing at deleted resources. The stub’s framing is the right one: low cost individually, a hygiene signal at scale. A zone full of records that resolve to released IPs or deleted load balancers says an environment was torn down carelessly. The same teardown probably left billing debris in more expensive types. Zones are not schedulable; DNS has no off-hours, so the platform’s role is inventory and flagging rather than any lifecycle action.
Dangling records and the risk beyond cost
The sharpest issue in a stale zone is not its fee but its dangling records. An A record still answering with an IP address that Google has since handed to another customer, or a CNAME aimed at a deprovisioned service, is a subdomain-takeover surface: whoever controls the target now receives traffic sent in your name. Cleanup order matters (records first, zone second), and any record pointing at an address flagged as released elsewhere in this directory should be treated as a security item, not a tidiness item.
Cloud DNS console path
Google Cloud console → Network services → Cloud DNS lists every managed zone with its record count and visibility (public or private). Opening a zone shows its record sets; auditing the A and CNAME targets against live infrastructure is a 10-minute exercise per zone that regularly finds both waste and exposure.