發布服務的 IAM 同源必須確認他們在 Google Search Console 中擁有網域的擁有者權限。詳情請參閱「使用 Private Service Connect 發布服務」一文中的「開始前」。
服務使用者的自動 DNS 設定
如果有下列設定，系統會自動為端點建立 DNS 項目：
服務供應者已為服務設定網域名稱。
端點已設定 IPv4 位址。
端點已註冊至 Service Directory 命名空間。
所有新端點都會自動註冊至 Service Directory，但舊端點可能不會註冊。
如果兩者皆存在，建立端點時，系統會建立名為 NAMESPACE--REGION 的 Service Directory DNS 區域。這個私人區域會儲存 REGION 區域中 Service Directory 命名空間 NAMESPACE 中找到的服務 DNS 項目。NAMESPACE--REGION 的字元上限為 63 個半形字元。
圖 1.
使用 Service Directory 為 Endpoints 自動設定 DNS (按一下可放大)。
建立端點後，您可以確認是否已建立 Service Directory DNS 區域。如果未建立 Service Directory DNS 區域，您可以手動建立類似的設定。詳情請參閱「查看 Service Directory DNS 區域」。
如果不想建立這些 DNS 項目，請採取下列任一做法：
如果您不打算將 Cloud DNS 用於其他用途，請停用 Cloud DNS API，或移除 Cloud DNS 所需的權限。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-05 (世界標準時間)。"],[],[],null,["# DNS configuration for published services\n========================================\n\nService producers can [publish services by using\nPrivate Service Connect](/vpc/docs/configure-private-service-connect-producer).\nThe service producer can optionally configure a DNS domain name to associate\nwith the service. If a domain name is configured, and a\n[service consumer creates an endpoint that targets that\nservice](/vpc/docs/configure-private-service-connect-services), Private Service Connect\nand Service Directory automatically create DNS entries for the\nservice in a private DNS zone in the service consumer's VPC\nnetwork.\n\nDNS configuration for service producers\n---------------------------------------\n\nWhen you publish a service (create a service attachment), you can optionally\nconfigure a DNS domain name.\n\nIf you configure a domain name for a service, when a Private Service Connect endpoint is created that connects to that\nservice, the following configurations are made in the service consumer's\nVPC network:\n\n- A [Service Directory DNS\n zone](/service-directory/docs/configuring-service-directory-zone) is created for\n the specified domain.\n\n- A DNS entry for each endpoint is\n created in the zone.\n\nThe recommended format for the domain name is\n\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e`.p.`\u003cvar translate=\"no\"\u003eDOMAIN\u003c/var\u003e. Because this domain name is\nused to create DNS entries in the service consumer's VPC network,\nit's important to use a name that doesn't conflict with any existing DNS domain\nnames. Using this format reduces the risk of conflicts.\n\nFor example, if the service is configured with the domain name\n`us-west1.p.example.com`, and the service consumer creates an\nendpoint with the name `analytics`, a DNS\nrecord for `analytics.us-west1.p.example.com` is automatically created.\n\nThe load balancer that is hosting the service must be able to accept requests\ndirected to this domain name. If you are using an internal Application Load Balancer, you\nmight need to update the load balancer configuration to reflect the domain\nnames that you want service consumers to use. For example, update\n[certificates](/load-balancing/docs/ssl-certificates) or\n[URL maps](/load-balancing/docs/url-map-concepts).\n\nThe same IAM principal that [publishes the\nservice](/vpc/docs/configure-private-service-connect-producer) must confirm that\nthey have Owner permissions for the domain in the Google Search\nConsole. For more information, see [Before you\nbegin](/vpc/docs/configure-private-service-connect-producer#before) in\n*Publish services by using Private Service Connect*.\n\nAutomatic DNS configuration for service consumers\n-------------------------------------------------\n\nIf the following configurations are present, DNS entries are automatically\ncreated for endpoints:\n\n- The service producer has configured a domain name for the service.\n\n- The endpoint is configured with an IPv4 address.\n\n- The endpoint is registered with a\n Service Directory namespace.\n\n All new endpoints are automatically registered with\n Service Directory, but older endpoints might not be registered.\n\nIf both configurations are present, when the\nendpoint is created, a [Service Directory DNS\nzone](/service-directory/docs/configuring-service-directory-zone) is created\nwith the name \u003cvar translate=\"no\"\u003eNAMESPACE\u003c/var\u003e`--`\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e.\nThis private zone stores DNS entries for services found in the\nService Directory namespace \u003cvar translate=\"no\"\u003eNAMESPACE\u003c/var\u003e in\nthe region \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e. The character limit for\n\u003cvar translate=\"no\"\u003eNAMESPACE\u003c/var\u003e`--`\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e is 63 characters or fewer.\n[](/static/vpc/images/private-service-connect-services-autodns.svg) **Figure 1.**\nAutomatic DNS configuration for\nendpoints using Service Directory (click to enlarge).\n\nAfter you create the endpoint, you can\nverify if a Service Directory DNS zone is created. If the\nService Directory DNS zone is not created, you can manually\ncreate a similar configuration. For more information, see [View\nService Directory DNS zones](/vpc/docs/configure-private-service-connect-services#view-private-zones).\n\nIf you don't want these DNS entries to be created, do one of the following:\n\n- If you're not using Cloud DNS for another purpose, disable the\n Cloud DNS API, or remove the permissions that are required for\n Cloud DNS.\n\n- Wait for the DNS zone to be created, then [Delete the DNS\n zone](/dns/docs/zones#deleting_a_managed_zone) manually.\n\n If you want to manually configure DNS, see [Configure DNS\n manually](/vpc/docs/configure-private-service-connect-services#configure-dns-manual)."]]
