VPC name resolution order

Each Virtual Private Cloud (VPC) network provides DNS name resolution services to the virtual machine (VM) instances that use it. When VMs use their metadata server 169.254.169.254 as their name server, Google Cloud searches for DNS records in the following order:

  • If your VPC network has an outbound server policy, Google Cloud forwards all DNS queries to those alternative servers. The VPC name resolution order consists only of this step.

  • If your VPC network does not have an outbound server policy:

    1. Google Cloud tries to find a private zone that matches as much of the requested record as possible (longest suffix matching). This includes the following:
      • Searching records that you created in private zones.
      • Querying the forwarding targets for forwarding zones.
      • Querying the name resolution order of another VPC network by using peering zones.
    2. Google Cloud searches the automatically created Compute Engine internal DNS records for the project.
    3. Google Cloud queries publicly available zones, following the appropriately configured start of authority (SOA). This includes Cloud DNS public zones.