In a Shared VPC model, service project owners must independently manage DNS zones, and workloads in any service project must resolve private zones defined in other service projects. How do you implement this?

The correct approach is to create a Cloud DNS private zone in each service project and use cross-project zone binding to associate each zone with the Shared VPC in the host project. This allows service project owners to manage their own DNS zones independently while ensuring that workloads across all service projects can resolve these private zones within the Shared VPC network. Creating a Cloud DNS private zone in each service project is correct for independent management. Cross-project zone binding is the mechanism that links these service project zones to the Shared VPC network in the host project, making them resolvable by all resources attached to that network. Cloud DNS forwarding zones are used to forward queries to external DNS servers, not for internal Shared VPC resolution. Cloud DNS peering zones are used to peer private zones between different VPC networks, not typically for binding service project zones to a host project's Shared VPC. Cloud DNS response policy zones are for custom responses to DNS queries, not for cross-project zone resolution in this context.