Configure DNS64

This document describes how to configure and use DNS64 server policies withVirtual Private Cloud (VPC) networks.

Before you begin

  • DNS64 server policies don't apply to dual-stack virtual machine (VM)instances, IPv4-only VM instances, serverless workloads, orrequests sent to endpoints created byaninbound DNS serverpolicy.
  • Make sure that you have the required permissions to create a DNS64 serverpolicy.

Permissions required for this task

To perform this task, you must have been granted the following permissionsor the following IAM roles.

Permissions

  • dns.policies.create to create a DNS64 server policy
  • dns.policies.delete to delete a DNS64 server policy
  • dns.policies.get to fetch the current configuration of a DNS64 server policy
  • dns.policies.list to list all DNS server policies associated with a project
  • dns.policies.update to update a DNS64 server policy
  • dns.managedZones.list to list managed zones

Roles

  • DNS Administrator (roles/dns.admin)

Create a DNS64 server policy

Create a DNS64 server policy to enable communication between IPv6-onlyworkloads and IPv4-only destinations.

After you create a DNS64 server policy, the following occurs whenan IPv6 (AAAA) record is queried:

  • If anAAAA DNS record exists, the DNS server returns an IPv6address. Your workload connects by using that IPv6 address.
  • If noAAAA DNS record exists, Cloud DNS looks forA records.Cloud DNS then creates IPv6 addresses for the IPv4 addresses in theA record, by using the64:ff9b::/96 IPv6 prefix.

To create a DNS64 server policy, follow these steps.

gcloud

To create a DNS64 server policy, run thegcloud dns policiescreate command:

gcloud dns policies createNAME \    --description=DESCRIPTION \    --networks=VPC_NETWORK_LIST \    --enable-dns64-all-queries

Replace the following:

  • NAME: a name for the policy
  • DESCRIPTION: a description for the policy
  • VPC_NETWORK_LIST: a comma-delimited list ofVPC networks that the DNS server policy binds to

Terraform

resource "google_dns_policy" "default" {  name = "NAME"  dns64_config {    scope {      all_queries = true    }  }  alternative_name_server_config {    target_name_servers {      ipv4_address    = "PRIVATE_IP_ADDRESS"      forwarding_path = "private"    }    target_name_servers {      ipv4_address = "PUBLIC_IP_ADDRESS"    }  }  networks {    network_url = google_compute_network.default.id  }}resource "google_compute_network" "default" {  name                    = "network"  auto_create_subnetworks = false}

Replace the following:

  • NAME: a name for the outbound DNS64 policy
  • PRIVATE_IP_ADDRESS: the IP address of an alternative name server using a private forwarding path
  • PUBLIC_IP_ADDRESS: the IP address of a different alternative name server

API

To create a DNS64 server policy, use thepolicies.create method:

POST https://dns.googleapis.com/dns/v1/projects/PROJECT_ID/policies{  "kind": "dns#policy",  "networks": [    {      "kind": "dns#policyNetwork",      "networkUrl": "NETWORK_URL"    }  ],  "dns64Config":    {        "scope":        {          allQueries: true,        }    }  }

Replace the following:

  • PROJECT_ID: your project ID.
  • NETWORK_URL: the fully qualified URL of theVPC network that your DNS server policy must bind to,formatted as follows:https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/VPC_NETWORK_NAME.Specify the network that contains the IPv6-only subnets and instances.

Verify if a DNS64 server policy is enabled

gcloud

To list all DNS server policies in your project, run thedns policies list command:

gcloud dns policies list

To get detailed information about a specific DNS64 server policy, run thegcloud dns policies describe command:

gcloud dns policies describeNAME

ReplaceNAME with the name of the DNS64 serverpolicy about which you want detailed information.

Disable a DNS64 server policy

gcloud

To disable a DNS64 server policy, run thedns policies update command:

gcloud dns policies updateNAME \    --no-enable-dns64-all-queries

ReplaceNAME with the name of the DNS64 serverpolicy that you want to disable.

What's next

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026-02-19 UTC.