Cloud DNS 范围是一种将专用 DNS 资源附加到 Google Cloud 对象的灵活方式。最初，您只能将专用 DNS 资源（例如专用 DNS 地区、政策和对等互连地区）连接到 Virtual Private Cloud (VPC) 网络。使用 DNS 范围，您不仅可以将资源挂接到多个 Google Cloud 网络，还可以将资源挂接到更小的分组（例如 Google Kubernetes Engine [GKE] 集群）。您可以将专用 DNS 资源附加到范围，而不是将网络 DNS 资源附加到网络。
借助 Cloud DNS 范围，您可以将专用 DNS 资源附加到 VPC 网络和 GKE 集群。您可以在特定范围的边界内（例如在网络中）创建自定义 DNS 视图。例如，一个网络中的多个 GKE 集群可以有自己的 cluster.local DNS 层次结构。
根据您希望向整个 VPC 网络显示 DNS 名称还是对 GKE 集群使用 DNS 名称，您可以创建 VPC 范围或 GKE 集群级 DNS 地区：
VPC 范围。如果 DNS 名称必须在网络范围内解析，请使用此范围。VPC 范围的 DNS 区域允许 DNS 名称可用于整个 VPC 网络。
GKE 集群范围。Cloud DNS 允许您为单个 GKE 集群创建范围。然后，您可以为每个集群创建一个或多个专用托管地区，就像为网络创建托管地区一样。来自该集群的查询首先检查该查询是否可由范围限定于该特定 GKE 集群的资源应答。否则，查询会回退到正常匹配，首先检查网络级资源是否可以解答查询。
范围层次结构
DNS 解析发生在最具体的可用范围内，而在较低范围内找不到地区时，将遍历层次结构。集群是最具体的范围，Cloud DNS 会先检查有无匹配项。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-20。"],[[["\u003cp\u003eCloud DNS scopes enable the attachment of private DNS resources to multiple Google Cloud networks or specific groupings like GKE clusters, offering enhanced flexibility compared to the previous VPC network-only method.\u003c/p\u003e\n"],["\u003cp\u003eDNS scopes allow for custom DNS views within their boundaries, such as multiple GKE clusters in a single network having their own \u003ccode\u003ecluster.local\u003c/code\u003e DNS hierarchy.\u003c/p\u003e\n"],["\u003cp\u003eYou can establish either a VPC-scoped DNS zone for network-wide DNS resolution or a GKE cluster-scoped DNS zone to confine DNS name resolution to a single GKE cluster.\u003c/p\u003e\n"],["\u003cp\u003eDNS resolution follows a hierarchy, starting with the most specific scope (the GKE cluster) and progressively checking broader scopes if a zone is not found.\u003c/p\u003e\n"],["\u003cp\u003eScopes enable managed zones and response policies to be bound to selectors within the same scope, allowing for flexible configurations between multiple networks, GKE clusters, or a combination of both.\u003c/p\u003e\n"]]],[],null,["# Scopes and hierarchies\n\nCloud DNS scopes are a flexible way of attaching private DNS resources\nto Google Cloud objects. Originally, you could only attach private DNS\nresources such as private DNS zones, policies, and peering zones to\nVirtual Private Cloud (VPC) networks. By using DNS scopes, you can\nattach resources not only to multiple Google Cloud networks, but also to a\nsmaller grouping, such as a Google Kubernetes Engine (GKE) cluster. Instead\nof attaching private DNS resources to networks, you can attach private DNS\nresources to scopes.\n\nCloud DNS scopes let you attach a private DNS resource to a\nVPC network and a GKE cluster.\nWithin the boundaries of a particular scope, like in a network, you can create\na custom view of DNS. For example, multiple GKE clusters in a\nsingle network can have their own `cluster.local` DNS hierarchy.\n\nYou can create a VPC-scoped or a GKE cluster-scoped\nDNS zone depending on whether you want DNS names to be visible to the entire\nVPC network or limit them to a GKE cluster:\n\n- **VPC scope**. Use this scope when DNS names have to\n be resolved VPC network-wide. A VPC-scoped\n DNS zone lets DNS names be available globally to the entire\n VPC network.\n\n- **GKE cluster scope**. Cloud DNS lets you\n create a scope for a single GKE cluster.\n You can then create one or more private managed zones for each\n cluster, just like you can for networks. Queries from within that\n cluster first check to see if the query can be answered by a\n resource scoped to that specific GKE cluster. If not, queries\n fall back to normal matching, which starts by checking if the query can be\n answered by any network-scoped resources.\n\nScopes hierarchy\n----------------\n\nDNS resolution occurs at the most specific scope available, walking up the\nhierarchy when a zone is not found in a lower scope. The cluster is the most\nspecific scope, and Cloud DNS checks it first for a match.\n\nScopes also let [managed zones](/dns/docs/key-terms#dns-managed-zones) and\n[response policies](/dns/docs/key-terms#response-policy) bind to one or more\nselectors within the same scope (when applicable). You can configure a network\nand a scope to bind in the following ways:\n\n- Between multiple networks\n- Between a GKE cluster and a network\n- Between multiple networks and multiple GKE clusters\n\nAfter you bind a managed zone or response policy to a selector, it is visible to\nclients within the scope.\n\nTo learn how to configure a cluster-scoped Cloud DNS zone, see\n[Configure a GKE cluster scope](/dns/docs/zones/configure-scopes).\n\nWhat's next\n-----------\n\n- To find solutions for common issues that you might encounter when using Cloud DNS, see [Troubleshooting](/dns/docs/troubleshooting).\n- To learn more about Cloud DNS response policies, see [Manage response policies and rules](/dns/docs/zones/manage-response-policies).\n- To learn more about zones, see [Create, modify, and delete zones](/dns/docs/zones)."]]
