Google CloudCloud DNSNetworking

`google_dns_policy` cost estimation

A network-level Cloud DNS policy for inbound or outbound forwarding, alternative name servers, and query logging. The policy is free. Cost lives in Cloud DNS zones and queries and in the logging it can enable.

The google_dns_policy resource applies DNS behavior to one or more VPC networks. It can enable inbound forwarding (so on-premises resolvers can query Google Cloud private zones through a set of inbound forwarder IPs), configure outbound forwarding to alternative name servers (so VMs resolve certain domains via your own DNS), toggle DNSSEC validation, and turn on DNS query logging. Creating the policy is free. Cloud DNS does not bill for the policy object itself.

Cloud DNS bills two main dimensions on the surrounding resources. Managed zones (google_dns_managed_zone) cost about $0.20/month per zone for the first 25 zones, then less per zone at higher counts. Queries cost about $0.40 per million for the first billion per month, dropping to about $0.20 per million beyond that. An outbound forwarding policy that sends a high volume of lookups to alternative name servers, or an inbound policy handling heavy on-premises query traffic, drives that per-million query charge.

The cost-adjacent gotcha specific to this resource is query logging. Enabling logging on a DNS policy sends every resolved query as a log entry to Cloud Logging, and Cloud Logging bills ingestion at about $0.50/GB after the first 50 GB per project each month. On a busy network resolving millions of queries, DNS logs can become a surprisingly large Cloud Logging line even though the policy and the queries themselves are cheap. If you enable logging for a short investigation and forget to turn it off, it quietly accrues ingestion cost.

The second consideration is inbound forwarder IPs. An inbound server policy allocates internal IP addresses in your subnets to act as forwarding targets. Those consume address space and tie into your hybrid networking, where cross-connectivity (Cloud Interconnect or VPN) carries its own cost for the traffic that flows once resolution succeeds.

c3x flags google_dns_policy as free and attributes zone, query, and logging cost to Cloud DNS and Cloud Logging respectively.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "google_dns_policy" "hybrid" {
  name                      = "hybrid-dns-policy"
  enable_inbound_forwarding = true
  enable_logging            = true

  alternative_name_server_config {
    target_name_servers {
      ipv4_address    = "10.0.0.53"
      forwarding_path = "private"
    }
    target_name_servers {
      ipv4_address    = "10.0.0.54"
      forwarding_path = "private"
    }
  }

  networks {
    network_url = google_compute_network.main.id
  }
}

Pricing dimensions

What you actually pay for when you provision google_dns_policy.

Dimension	Unit	What's being charged
DNS policy	free	The policy object, including inbound and outbound forwarding configuration, carries no per-resource charge. $0 (free)
Managed zone	per month per zone	Each Cloud DNS managed zone, for the first 25 zones. Cheaper per zone beyond that. about $0.20/month per zone
DNS queries	per million queries	Resolutions handled by Cloud DNS, including those routed by forwarding policies. First billion per month, then cheaper. about $0.40 per million
Query logging (Cloud Logging)	per GB	DNS query logs enabled by the policy are ingested into Cloud Logging beyond the free 50 GB per project. about $0.50/GB

Optimization tips

Common ways to reduce google_dns_policy cost without changing the workload.

Turn off DNS query logging when you are done with it

Often the largest cost tied to a DNS policy

Query logging sends every resolution to Cloud Logging at about $0.50/GB after the free tier. On a busy network this becomes a large ingestion line. Enable it for investigations, then disable it, rather than leaving it on by default.

Consolidate managed zones

Each managed zone bills about $0.20/month. Avoid creating near-duplicate private zones per environment when a single zone with appropriate records would serve. It is small per zone but adds up across large estates.

Cache and reduce chatty lookups

Outbound forwarding queries count toward the per-million query charge. Sensible client-side and resolver caching reduces query volume and the traffic that flows over hybrid links after resolution.

Right-size inbound forwarder scope

Only attach inbound forwarding to networks that genuinely need on-premises resolution. Each network attachment expands the resolution surface and the hybrid traffic that can follow, which carries interconnect or VPN cost.

FAQ

Does a Cloud DNS policy cost anything?

No. The policy is free, including its inbound and outbound forwarding configuration. You pay for managed zones (about $0.20/month each) and queries (about $0.40 per million), plus Cloud Logging if you enable query logging.

What is the hidden cost of enabling query logging?

Query logging routes every DNS resolution to Cloud Logging, billed at about $0.50/GB after the free 50 GB per project each month. On a network resolving millions of queries, this can become a significant and easily forgotten Cloud Logging charge.

How are DNS queries billed?

Cloud DNS charges about $0.40 per million queries for the first billion per month, then about $0.20 per million beyond that. Queries routed through outbound or inbound forwarding policies count toward this total.

Does inbound forwarding add cost beyond DNS?

Indirectly. Inbound forwarding enables on-premises resolution, and the traffic that flows afterward travels over Cloud Interconnect or Cloud VPN, which carry their own charges. The DNS policy and resolution are cheap; the connectivity they enable may not be.