이 페이지에서는 Cloud SQL 인스턴스에 커스텀 DNS(도메인 이름 시스템) 이름을 설정하는 방법을 설명합니다.
개요
조직에서 관리하는 커스텀 DNS 이름을 사용하여 애플리케이션에 연결할 수 있도록 Cloud SQL 인스턴스를 구성할 수 있습니다.
IP 주소를 사용하는 대신 커스텀 DNS 이름을 사용하여 Cloud SQL 인스턴스에 연결하려면 커스텀 주체 대체 이름(SAN)을 구성합니다. 인스턴스를 만들거나 업데이트할 때 커스텀 SAN을 구성할 수 있습니다.
인스턴스에 커스텀 DNS 이름을 커스텀 SAN 구성으로 추가하면 Cloud SQL이 인스턴스 서버 인증서의 SAN 필드에 커스텀 DNS 이름을 삽입합니다. 이렇게 맞춤설정하면 호스트 이름 검증을 거쳐 커스텀 DNS 이름을 안전하게 사용할 수 있습니다.
커스텀 SAN 구성에 쉼표로 구분된 커스텀 DNS 이름 목록을 최대 3개까지 추가할 수 있습니다. 보안상의 이유로 서버 CA 모드가 CUSTOMER_MANAGED_CAS_CA로 구성된 인스턴스에서만 커스텀 SAN 구성을 사용할 수 있습니다.
클라이언트와 애플리케이션에서 커스텀 DNS 이름을 사용하여 인스턴스에 연결하려면 먼저 DNS 이름과 IP 주소 사이에 매핑을 설정해야 합니다. 이 매핑을 DNS 변환이라고 합니다. 비공개로 연결하는 경우 해당 가상 프라이빗 클라우드(VPC) 네트워크의 비공개 DNS 영역에 DNS 레코드를 만듭니다.
애플리케이션에서 사용하는 DNS 영역에 DNS 레코드 두 개를 추가합니다.
직접 관리하는 DNS 서버 또는 애플리케이션에서 사용하는 Cloud DNS 비공개 영역을 사용할 수 있습니다.
인스턴스의 IP 주소에 대한 A 레코드 만들기
인스턴스 연결 이름이 포함된 TXT 레코드 만들기
표준 데이터베이스 클라이언트는 A 레코드를 사용하여 연결할 IP 주소를 조회합니다. Cloud SQL 언어 커넥터와 Cloud SQL 인증 프록시는 TXT 레코드를 사용하여 인스턴스 연결 이름을 조회합니다.
예를 들어 인스턴스의 연결 문자열은 my-project:region:my-instance이지만 DNS 이름 prod-db.mycompany.example.com을 사용하여 연결할 수 있습니다.
회사 네트워크의 인스턴스 IP 주소가 192.0.2.4인 경우 다음 DNS 레코드를 만듭니다.
Record type: A
Name: prod-db.mycompany.example.com
Value: 192.0.2.4
TTL: 600
Record type: TXT
Name: prod-db.mycompany.example.com
Value: my-project:region:my-instance
TTL: 600
커스텀 DNS 이름을 사용하여 인스턴스에 연결
SQL Server용 Cloud SQL 인스턴스에 연결할 때 커스텀 DNS 이름을 호스트 이름으로 구성합니다. 그런 다음 sqlcmd에 -N 플래그를 지정하거나 SSMS의 연결 암호화/암호화 옵션을 선택하여 서버 본인 인증을 사용 설정합니다.
다른 SQL Server 드라이버에는 유사한 플래그 또는 구성이 있습니다.
외부 네트워크에서 비공개 Cloud SQL 인스턴스에 연결하는 경우 외부 연결을 허용하고 Cloud DNS가 온프레미스 시스템과 통신할 수 있도록 Cloud SQL 인스턴스와 해당 가상 프라이빗 클라우드(VPC) 네트워크를 구성해야 합니다. 이 구성에 대한 자세한 내용은 외부 소스에서 연결 및 온프레미스 시스템의 DNS 구성을 참조하세요.
제한사항
Cloud SQL 인스턴스의 서버 인증서에 커스텀 SAN 값으로 DNS 이름을 4개 이상 추가할 수 없습니다.
인스턴스의 커스텀 SAN 값으로 인증서에 추가할 수 있는 DNS 이름의 최대 길이는 253자(영문 기준)입니다.
인스턴스 인증서에 추가하는 DNS 이름에는 와일드 카드 문자(*) 또는 마침표를 사용할 수 없습니다. 예를 들어 test.example.com.은 허용되지 않습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-08-19(UTC)"],[],[],null,["# Set up a custom DNS name for a Cloud SQL instance\n\n\u003cbr /\u003e\n\n[MySQL](/sql/docs/mysql/custom-dns-name \"View this page for the MySQL database engine\") \\| [PostgreSQL](/sql/docs/postgres/custom-dns-name \"View this page for the PostgreSQL database engine\") \\| SQL Server\n\n\u003cbr /\u003e\n\nThis page describes how to set up a custom domain name system\n(DNS) name for your Cloud SQL instance.\n\nOverview\n--------\n\nYou can configure a Cloud SQL instance so that your applications can\nconnect using a custom DNS name managed by your organization.\nIf you want to use a custom DNS name to connect to a Cloud SQL\ninstance instead of using an IP address, then configure a custom\nsubject alternative name (SAN). You can configure a custom SAN\nwhen you create or update an instance.\n\nWhen you add a custom DNS name as a custom SAN configuration to your instance,\nCloud SQL inserts the custom DNS name\nto the SAN field of the server certificate of the instance. This customization\nlets you use the custom DNS name with [hostname validation](/sql/docs/sqlserver/configure-ssl-verification#server-identity-verification) securely.\nYou can add a comma-separated list of up to three custom DNS names to the\ncustom SAN configuration. For security reasons, you can use a custom SAN configuration\nonly for instances that you\n[configure with `CUSTOMER_MANAGED_CAS_CA`](/sql/docs/sqlserver/customer-managed-ca)\nas the server CA mode.\n\nAfter you configure the custom DNS name for your instance, you can use that\ncustom DNS name to connect your database clients or applications, including\n[Cloud SQL Language Connectors](/sql/docs/sqlserver/language-connectors) and\nthe [Cloud SQL Auth Proxy](/sql/docs/sqlserver/sql-proxy).\n\n### Workflow\n\nTo set up a custom DNS name for an instance, do the following:\n\n1. Create an instance configured with customer-managed CA.\n2. Add custom SAN values to the instance. The custom SAN values are inserted into the SAN field of the server certificate of the instance.\n3. Determine the IP address of the instance.\n4. Create custom DNS records for your instance.\n5. Connect to the instance using the custom DNS name.\n\nBefore you begin\n----------------\n\nBefore you set up a custom DNS name for your instance, make sure you have\nthe [required roles and permissions](/sql/docs/sqlserver/customer-managed-ca#required-roles).\n\nIf you are creating a new Cloud SQL instance, then to use custom SAN,\nyour instance must also use a\n[customer-managed certificate authority (CA)](/sql/docs/sqlserver/customer-managed-ca) for its\nserver CA mode.\n\nCreate an instance with custom SAN values\n-----------------------------------------\n\nTo create an instance with custom SAN values, use the following [gcloud sql instances create](/sdk/gcloud/reference/sql/instances/create) command: \n\n### gcloud\n\n```bash\ngcloud sql instances create \"\u003cvar translate=\"no\"\u003eINSTANCE_NAME\u003c/var\u003e\" \\\n --database-version=DATABASE_VERSION \\\n --project=PROJECT_ID \\\n --region=REGION \\\n --server-ca-mode=CUSTOMER_MANAGED_CAS_CA \\\n --server-ca-pool=projects/PROJECT_ID_CAS/locations/REGION/caPools/CA_POOL_ID\n --custom-subject-alternative-names=CUSTOM_DNS_NAME\n```\n\nMake the following replacements:\n\n- \u003cvar translate=\"no\"\u003eINSTANCE_NAME\u003c/var\u003e with the name of the Cloud SQL instance that you want to create.\n- \u003cvar translate=\"no\"\u003eDATABASE_VERSION\u003c/var\u003e with the [`enum` of the version](/sql/docs/sqlserver/admin-api/rest/v1/SqlDatabaseVersion) of the Cloud SQL instance that you want to create.\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with the ID of the project where you plan to create your Cloud SQL instances.\n- \u003cvar translate=\"no\"\u003ePROJECT_ID_CAS\u003c/var\u003e with the ID of the project where you created your \u003cvar translate=\"no\"\u003eCA_POOL_ID\u003c/var\u003e. This project might be the same or different from where you want to create your Cloud SQL instance.\n- \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e with the region where you created the CA pool. You must create your instance in the same region as the CA pool.\n- \u003cvar translate=\"no\"\u003eCA_POOL_ID\u003c/var\u003e with the ID of the CA pool that you created.\n- \u003cvar translate=\"no\"\u003eCUSTOM_DNS_NAME\u003c/var\u003e with up to three custom DNS names, comma-separated with no spaces in between the values. For example, `develop.example.com,test.example.com,production.example.com`.\n\nAdd or update custom SAN values for an instance\n-----------------------------------------------\n\nTo add or update custom SAN values for an existing instance,\ndo the following: \n\n### gcloud\n\n```bash\ngcloud sql instances patch INSTANCE_NAME \\\n --custom-subject-alternative-names=CUSTOM_DNS_NAME\n```\nCaution: If you're updating an instance that already has custom SAN values, then specify the existing custom SAN values or the existing values will be replaced.\n\nMake the following replacements:\n\n- \u003cvar translate=\"no\"\u003eINSTANCE_NAME\u003c/var\u003e with the name of the Cloud SQL instance that you want to update.\n- \u003cvar translate=\"no\"\u003eCUSTOM_DNS_NAME\u003c/var\u003e with up to three custom DNS names, comma-separated with no spaces in between the values. For example, `develop.example.com,new-test.example.com,production.example.com`.\n\nClear all custom SAN values from an instance\n--------------------------------------------\n\nTo clear all custom SAN values from an instance,\ndo the following: \n\n### gcloud\n\n```bash\ngcloud sql instances patch INSTANCE_NAME \\\n --clear-custom-subject-alternative-names\n```\n\nReplace \u003cvar translate=\"no\"\u003eINSTANCE_NAME\u003c/var\u003e with the name of the Cloud SQL\ninstance that you want to update.\n\nCreate custom DNS records\n-------------------------\n\nBefore you can connect to the instance using the custom DNS name with\nyour clients and applications, set up the mapping between the DNS name\nand the IP address. This mapping\nis known as DNS resolution. If you are connecting privately, then\n[create the DNS record in a private DNS zone](/dns/docs/set-up-dns-records-domain-name)\nin the corresponding Virtual Private Cloud (VPC)\nnetwork.\n\nTo create custom DNS records for your instance, do the following:\n\n1. Retrieve the IP address for your instance. Run the following command:\n\n ```bash\n gcloud sql instances describe INSTANCE_NAME \\\n --project=PROJECT_ID\n ```\n\n Make the following replacements:\n - \u003cvar translate=\"no\"\u003eINSTANCE_NAME\u003c/var\u003e: the name of the Cloud SQL instance\n - \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the ID or [project number](/resource-manager/docs/creating-managing-projects#identifying_projects) of the Google Cloud project that contains the instance\n2. In the response, look for the\n `ipAddresses:` field.\n\n For example: \n\n ipAddresses:\n - ipAddress: 192.0.2.4\n type: PRIVATE\n\n You can retrieve the private IP address for an instance configured for\n [private services access](/sql/docs/sqlserver/configure-private-services-access), [Private Service Connect](/sql/docs/sqlserver/configure-private-service-connect), or [both](/sql/docs/sqlserver/configure-private-services-access-and-private-service-connect).\n | **Warning**: For security reasons, we don't recommend setting up custom DNS records for the public IP address of an instance.\n3. Add two DNS records to a DNS zone used by your application.\n You can use a DNS server that you manage yourself or\n the [Cloud DNS private zone](/dns/docs/zones#create-private-zone) used by your application.\n\n - Create an `A` record for the IP address of the instance\n - Create a `TXT` record containing the instance connection name.\n\n Standard database clients use the `A` record to look up the IP address\n to make the connection. Cloud SQL Language Connectors and the Cloud SQL Auth Proxy\n use the `TXT` record to look up the instance connection name.\n\n For example, the connection string for your instance is `my-project:region:my-instance`,\n but you want to connect using the DNS name\n `prod-db.mycompany.example.com`.\n If the IP address of the instance on your company network is `192.0.2.4`,\n then create the following DNS records: \n\n Record type: A\n Name: prod-db.mycompany.example.com\n Value: 192.0.2.4\n TTL: 600\n\n Record type: TXT\n Name: prod-db.mycompany.example.com\n Value: my-project:region:my-instance\n TTL: 600\n\nConnect to an instance using a custom DNS name\n----------------------------------------------\n\nWhen you connect to the Cloud SQL for SQL Server instance, configure the custom DNS name as the hostname. Then enable server identity verification verification by specifying the `-N` flag for `sqlcmd` or by selecting the **Encrypt Connection/Encryption** option of SSMS.\n\n\u003cbr /\u003e\n\nOther SQL Server drivers have similar flags or configurations.\n\n\nIf you're connecting to a private Cloud SQL instance\nfrom an external network, then you must configure your Cloud SQL instance\nand its Virtual Private Cloud (VPC) network to permit external\nconnections and to let Cloud DNS communicate with on-premises\nsystems. For more information about this configuration, see [Connect from an external source](/sql/docs/mysql/configure-private-ip#vpn) and [Configure DNS for on-premises systems](/vpc/docs/configure-private-google-access-hybrid#config-dns-onpremises).\n\nLimitations\n-----------\n\n- You can't add more than three DNS names as custom SAN values to the server certificate of a Cloud SQL instance.\n- The maximum length of a DNS name that you can add to the certificate as a custom SAN value for an instance is 253 characters.\n- The DNS names that you add to the certificate for an instance can't have wildcard characters (`*`) or trailing dots. For example, `test.example.com.` isn't allowed.\n- The DNS names must be valid, as specified by [RFC 1034](https://datatracker.ietf.org/doc/html/rfc1034).\n- You can specify custom SAN values for `CUSTOMER_MANAGED_CAS_CA` instances only.\n\nWhat's next\n-----------\n\n- [Manage](/sql/docs/sqlserver/manage-ssl-instance) SSL/TLS certificates on your Cloud SQL instance.\n- Learn more about [how encryption is handled in Google Cloud](/security/encryption-in-transit)."]]
