Cloud DNS 範圍是將私人 DNS 資源附加至 Google Cloud 物件的彈性方式。原本，您只能將私人 DNS 區域、政策和對等互連區域等私人 DNS 資源附加至虛擬私有雲 (VPC) 網路。使用 DNS 範圍後，您不僅可以將資源連結至多個 Google Cloud 網路，還可以連結至較小的群組，例如 Google Kubernetes Engine (GKE) 叢集。您可以將私人 DNS 資源附加至範圍，而非附加至網路。
Cloud DNS 範圍可讓您將私人 DNS 資源附加至 VPC 網路和 GKE 叢集。您可以在特定範圍 (例如網路) 的邊界內，建立 DNS 的自訂檢視畫面。舉例來說，單一網路中的多個 GKE 叢集可以擁有各自的 cluster.local DNS 階層。
您可以根據是否要讓 DNS 名稱對整個 VPC 網路可見，或將其限制在 GKE 叢集內，來建立 VPC 範圍或 GKE 叢集範圍的 DNS 區域：
虛擬私有雲範圍。如需在整個 VPC 網路中解析 DNS 名稱，請使用這個範圍。虛擬私有雲範圍 DNS 區域可讓 DNS 名稱在全球範圍內提供給整個虛擬私有雲網路。
GKE 叢集範圍。Cloud DNS 可讓您為單一 GKE 叢集建立範圍。接著，您可以為每個叢集建立一或多個私人代管區域，就像為網路建立區域一樣。該叢集中的查詢會先檢查查詢是否可由特定 GKE 叢集的資源回答。如果沒有，查詢會改為使用一般比對方式，首先檢查是否有任何網路範圍的資源可回答查詢。
範圍階層
DNS 解析會在可用的最具體範圍中發生，如果在較低範圍中找不到區域，就會向上逐層搜尋。叢集是最具體的範圍，Cloud DNS 會先檢查這個範圍是否有相符項目。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eCloud DNS scopes enable the attachment of private DNS resources to multiple Google Cloud networks or specific groupings like GKE clusters, offering enhanced flexibility compared to the previous VPC network-only method.\u003c/p\u003e\n"],["\u003cp\u003eDNS scopes allow for custom DNS views within their boundaries, such as multiple GKE clusters in a single network having their own \u003ccode\u003ecluster.local\u003c/code\u003e DNS hierarchy.\u003c/p\u003e\n"],["\u003cp\u003eYou can establish either a VPC-scoped DNS zone for network-wide DNS resolution or a GKE cluster-scoped DNS zone to confine DNS name resolution to a single GKE cluster.\u003c/p\u003e\n"],["\u003cp\u003eDNS resolution follows a hierarchy, starting with the most specific scope (the GKE cluster) and progressively checking broader scopes if a zone is not found.\u003c/p\u003e\n"],["\u003cp\u003eScopes enable managed zones and response policies to be bound to selectors within the same scope, allowing for flexible configurations between multiple networks, GKE clusters, or a combination of both.\u003c/p\u003e\n"]]],[],null,["# Scopes and hierarchies\n\nCloud DNS scopes are a flexible way of attaching private DNS resources\nto Google Cloud objects. Originally, you could only attach private DNS\nresources such as private DNS zones, policies, and peering zones to\nVirtual Private Cloud (VPC) networks. By using DNS scopes, you can\nattach resources not only to multiple Google Cloud networks, but also to a\nsmaller grouping, such as a Google Kubernetes Engine (GKE) cluster. Instead\nof attaching private DNS resources to networks, you can attach private DNS\nresources to scopes.\n\nCloud DNS scopes let you attach a private DNS resource to a\nVPC network and a GKE cluster.\nWithin the boundaries of a particular scope, like in a network, you can create\na custom view of DNS. For example, multiple GKE clusters in a\nsingle network can have their own `cluster.local` DNS hierarchy.\n\nYou can create a VPC-scoped or a GKE cluster-scoped\nDNS zone depending on whether you want DNS names to be visible to the entire\nVPC network or limit them to a GKE cluster:\n\n- **VPC scope**. Use this scope when DNS names have to\n be resolved VPC network-wide. A VPC-scoped\n DNS zone lets DNS names be available globally to the entire\n VPC network.\n\n- **GKE cluster scope**. Cloud DNS lets you\n create a scope for a single GKE cluster.\n You can then create one or more private managed zones for each\n cluster, just like you can for networks. Queries from within that\n cluster first check to see if the query can be answered by a\n resource scoped to that specific GKE cluster. If not, queries\n fall back to normal matching, which starts by checking if the query can be\n answered by any network-scoped resources.\n\nScopes hierarchy\n----------------\n\nDNS resolution occurs at the most specific scope available, walking up the\nhierarchy when a zone is not found in a lower scope. The cluster is the most\nspecific scope, and Cloud DNS checks it first for a match.\n\nScopes also let [managed zones](/dns/docs/key-terms#dns-managed-zones) and\n[response policies](/dns/docs/key-terms#response-policy) bind to one or more\nselectors within the same scope (when applicable). You can configure a network\nand a scope to bind in the following ways:\n\n- Between multiple networks\n- Between a GKE cluster and a network\n- Between multiple networks and multiple GKE clusters\n\nAfter you bind a managed zone or response policy to a selector, it is visible to\nclients within the scope.\n\nTo learn how to configure a cluster-scoped Cloud DNS zone, see\n[Configure a GKE cluster scope](/dns/docs/zones/configure-scopes).\n\nWhat's next\n-----------\n\n- To find solutions for common issues that you might encounter when using Cloud DNS, see [Troubleshooting](/dns/docs/troubleshooting).\n- To learn more about Cloud DNS response policies, see [Manage response policies and rules](/dns/docs/zones/manage-response-policies).\n- To learn more about zones, see [Create, modify, and delete zones](/dns/docs/zones)."]]
