Google Cloud DNS API
Browse all Google APIs36
AI ReadinessNon-Ready (F)36/100
Official vendor OpenAPI document · agent-readyCloud InfrastructureNetworkingoauth240 EndpointsREST
For Agents
Manage authoritative DNS zones, records, and DNSSEC programmatically across public and private zones on Google Cloud.
Use for: Create a new managed DNS zone for example.com, Add an A record pointing api.example.com to a Compute Engine VM IP, List all record sets in a managed zone, Delete a stale CNAME record
Not supported: Does not register domains, run resolvers, or terminate TLS - use for authoritative DNS zone and record management on Google Cloud only.
Google Cloud DNS is a high-availability, low-latency authoritative DNS service. The API exposes managed zones, resource record sets, atomic change transactions, DNSSEC keys, response policies, and per-project DNS policies so platform teams can automate authoritative DNS at scale across public and private (split-horizon) zones. It supports BIND zone files, DNSSEC, and integration with Google Cloud VPC for private DNS resolution.
Install Jentic One Beta
Connect the Cloud DNS API to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Cloud DNS API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fgoogleapis.com%2Fdns" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fgoogleapis.com%2Fdns" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Cloud DNS API.
Create, list, and delete managed DNS zones (public and private)
Apply atomic record-set changes via the changes endpoint with additions and deletions
Sign zones with DNSSEC and rotate DNS keys
Configure response policies and rules to override DNS resolution
Set per-project DNS policies for VPC private resolution
Audit DNS change operations to track who changed what and when
Use Cases
Patterns agents use Cloud DNS API for, with concrete tasks.
★ Atomic DNS Record Updates
Use the changes endpoint to apply DNS updates atomically - additions and deletions go together as one transaction. Operators encode a deploy in a Change request: add the new A record, remove the old one. Cloud DNS guarantees both apply or neither, avoiding the dangling-record problem common in scripted updates.
Submit a change to managed zone example-com that adds an A record api.example.com pointing to 35.190.10.20 and deletes the prior A record pointing to 35.190.10.10.
DNSSEC Lifecycle Management
Enable DNSSEC on a managed zone and manage key rotation through the dnsKeys endpoints. Platform teams pull the key-signing key info, publish DS records at the registrar, and verify chain-of-trust automatically. The API exposes algorithm, key-tag, and digest fields needed for parent-zone delegation.
Update managed zone example-com to set dnssecConfig.state to ON, then list dnsKeys for that zone and return the keySigning key tag and digest.
Private VPC DNS for Microservices
Stand up private DNS zones bound to a VPC so internal services resolve via DNS instead of hardcoded IPs. The managedZones endpoint creates a zone with visibility set to PRIVATE and a private network binding; rrsets populate per-service A records. Useful for Kubernetes, GCE, and Cloud Run service discovery without an external resolver.
Create a private managed zone services.internal scoped to VPC default in project p-prod, then add A records for cart.services.internal, orders.services.internal, and inventory.services.internal.
Agent-Driven Record Hygiene
Through Jentic, an AI agent can list every record set across all managed zones in a project, flag records pointing to deallocated IPs, and propose a clean-up change for human approval. Credentials are scoped per agent run by your Jentic One instance - the operator sees a summary without the agent ever seeing raw service-account keys.
Use Jentic to list managedZones for project p-prod, then for each zone list rrsets, returning record sets whose A target IP is no longer present in Compute Engine.
Key Endpoints
40 endpoints — google cloud dns is a high-availability, low-latency authoritative dns service.
METHOD
PATH
DESCRIPTION
GET
/dns/v1/projects/{project}/managedZones
List managed zones in a project
POST
/dns/v1/projects/{project}/managedZones
Create a managed zone
GET
/dns/v1/projects/{project}/managedZones/{managedZone}
Get a managed zone
POST
/dns/v1/projects/{project}/managedZones/{managedZone}/changes
Apply an atomic record-set change
GET
/dns/v1/projects/{project}/managedZones/{managedZone}/dnsKeys
List DNSSEC keys for a managed zone
GET
/dns/v1/projects/{project}/managedZones
List managed zones in a project
POST
/dns/v1/projects/{project}/managedZones
Create a managed zone
GET
/dns/v1/projects/{project}/managedZones/{managedZone}
Get a managed zone
POST
/dns/v1/projects/{project}/managedZones/{managedZone}/changes
Apply an atomic record-set change
GET
/dns/v1/projects/{project}/managedZones/{managedZone}/dnsKeys
List DNSSEC keys for a managed zone
Jentic AI Readiness Score
This API is usable in Jentic One now. Its AI-readiness score against Jentic's framework shows where it stands today and where improvements would make it even easier for agents to use.
C
Cloud DNS API
- Non-Ready (F)36/100
64
Foundational Compliance56
Developer Experience & Jentic Compatibility15
AI-Readiness & Agent Experience94
Agent Usability63
Security60
AI DiscoverabilityPowered by JenticScoring Framework 1.0.0 | Scoring Engine 0.4.0
Show dimension breakdown
64
Foundational Compliance
Base layer of spec validity and structural soundness.
Grade: BSignals: 4
81%
Lint Results
Aggregated quality score from linter diagnostics, weighted by severity.
100%
Resolution Completeness
Percentage of `$ref` references that resolve successfully.
0%
Specification Validity
Checks whether the API description parses successfully and conforms to its declared specification (e.g., OpenAPI).
75%
Structural Integrity
Structural correctness score based on schema issues using logarithmic dampening.
56
Developer Experience & Jentic Compatibility
Clarity, completeness, and ingestion readiness for developers and tooling.
Grade: CSignals: 4
0%
Example Density
How richly the API is illustrated with examples.
100%
Example Validity
Percentage of examples that conform to their schemas.
25%
Response Coverage
Percentage of operations with complete response definitions (success, client error, server error).
100%
Tooling Readiness
Health of API ingestion, bundling, and resolution within Jentic pipelines.
15
AI-Readiness & Agent Experience
Semantic breadth, depth, and agent comprehension for AI systems.
Grade: FSignals: 4
59%
Description Coverage
Coverage of descriptions across API elements.
0%
Error Standardization
Coverage of RFC 9457 Problem Details for error responses.
0%
OperationId Quality
Coverage, uniqueness, and casing consistency of operationIds for AI inference.
0%
Summary Coverage
Coverage of summaries across operations/tags/info.
94
Agent Usability
Functional utility, complexity comfort, and AI orchestration readiness.
Grade: A+Signals: 1
94%
Complexity Comfort
Agent comfort level based on API operational and structural complexity.
63
Security
Trust, risk posture, and security compliance.
Grade: B-Signals: 1
62%
Authentication Strength
Average quality of security schemes based on authentication method strength (weakest link for OAuth2).
60
AI Discoverability
Findability, semantic richness, and reasoning readiness.
Grade: B-Signals: 1
60%
Descriptive Richness
Clarity and depth of descriptions across API elements.
Score it yourself
Every API in the directory is allowlisted, so you can re-score it with no key required.
npx @jentic/api-scorecard-cli score <openapi-url>Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring the Cloud DNS API by hand means standing up Google OAuth2 with the right scopes, targeting dns.googleapis.com, and threading project and managed-zone ids through every zone and record call yourself. Through Jentic you install once, import the Cloud DNS API from the API Directory, store the OAuth credential once, and your agent calls it.
Permission scoping
Cloud DNS puts the project and managed zone in the URL path (/dns/v1/projects/{project}/managedZones/{managedZone}/...), so a rule can pin your agent to one project or zone: it can list zones and read changes and DNS keys there and nothing else. You choose the operations it may call, so record-changing operations are not included unless you add them.
Credential isolation
Your Google OAuth credential for Cloud DNS is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'list managed DNS zones' or 'create a record change', and Jentic returns the matching Cloud DNS operation with its input schema so the agent calls the right endpoint without browsing the reference docs.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Cloud DNS API through Jentic.
What authentication does the Cloud DNS API use?
OAuth 2.0 with the cloud-platform or ndev.clouddns.readwrite scope. Through Jentic, OAuth tokens are scoped per agent run and stored encrypted in your Jentic One instance, so service-account JSON keys never enter the agent runtime.
Can I make atomic DNS updates with Cloud DNS?
Yes. The changes endpoint at /dns/v1/projects/{project}/managedZones/{managedZone}/changes accepts a list of additions and deletions in one request and applies them as a single transaction - both apply or neither does.
What are the rate limits for the Cloud DNS API?
Cloud DNS enforces per-project write quotas (default 240 changes per minute) and per-zone limits on records (default 10,000). Read quotas are higher. Check current quotas in the Google Cloud Console under APIs and Services.
How do I list managed zones through Jentic?
Search 'list Google Cloud DNS managed zones', load the schema for /dns/v1/projects/{project}/managedZones, then execute it with your project ID. Jentic returns the parsed zone list.
Does Cloud DNS support DNSSEC?
Yes. Set dnssecConfig.state to ON on a managed zone and Cloud DNS generates the signing keys. Use the dnsKeys endpoint to retrieve the key-signing key fingerprint and publish a DS record at the registrar to complete the chain.
Is the Cloud DNS API free?
No. Cloud DNS charges per managed zone per month and per million queries. The first 25 zones and first billion queries each month are at base rates; beyond that, tiered pricing applies. Check current pricing in the Google Cloud Console.
Can I limit what my agent is allowed to do with the Cloud DNS API?
Yes. Because the Cloud DNS API puts the project and managed zone in the URL path, your self-hosted Jentic One instance lets you write a rule that pins your agent to a single project or zone, so it can only act where you allow. You also choose which operations it may call, so you can let it list managed zones and read changes and DNS keys while withholding the atomic record-set change endpoint that alters records. Your own rules, running in the instance you host, decide exactly which operations and which stored Google OAuth credential the agent may use.
GET STARTED