Enable Cloud DNS for the project and confirm the account's billing and service prerequisites. Create a dedicated service account with the DNS permissions required by your operation. The module's setup guidance uses the DNS Administrator role; a deliberately narrower custom role must still allow the exact zone and record operations you intend to use.

Create a JSON key only through an authorised service-account workflow. An organisation may prohibit downloadable keys. In that case, have the organisation administrator review the integration's supported authentication requirements instead of weakening a policy or pasting an unrelated credential.

1. Add a Domain Nexus server and choose Google Cloud DNS.
2. Paste the full key file into Service account key (JSON), preserving the JSON content.
3. If maintaining an older split-field configuration, enter Project ID, Service Account Email and the complete PEM private key instead. Use one coherent set from the same credential.
4. Save and run the check, which attempts to list a managed zone in the selected project.
5. Assign a test package and confirm that an intended public managed zone can be read and updated.

Google's managed-zone resource name and the public DNS domain name are different identifiers. The adapter discovers the provider zone and its assigned nameservers. Use the nameservers belonging to the actual public zone when preparing registrar delegation, and avoid adopting an unrelated private-zone configuration as public DNS.

The service account may have permission to list zones but lack permission to create a managed zone or submit record changes. Verify the role in the selected project, key validity, API enablement and the complete provider error. If the wrong project was selected, correct the connection and recheck ownership before synchronising records. Rotate or revoke the downloaded key when retiring the integration; keep its replacement available to both web requests and background jobs.

• Rotate a DNS provider credential across all connections that use it
• Run a controlled DNS provider acceptance check before assigning customer packages
• Discover existing DNS zones and link only verified customer ownership
• Connect Hetzner DNS using the current Cloud Console project token
• Connect Rackspace Cloud DNS with the matching tenant and regional endpoint

• Google Cloud DNS: Access control
• Google Cloud: Create and delete service account keys