Internal VMs in the same VPC must access myglobalapp.terramearth.com privately (cannot use the global external IP). Public DNS currently resolves the name to the public IP. Following Google best practices, how do you configure Cloud DNS so internal clients reach the application via its private IP?

Creating a Cloud DNS private zone for myglobalapp.terramearth.com and binding it to the VPC allows internal VMs to resolve the name to the application's private IP address. This is a best practice for split-horizon DNS, where internal clients receive different DNS responses than external clients. Cloud DNS private zones override public DNS records for specified domains within the bound VPCs, ensuring private access without altering public DNS. The option to create internal.terramearth.com doesn't directly solve the problem for myglobalapp.terramearth.com without client-side configuration changes. Query logic scripts are not a standard Cloud DNS feature for this scenario. Modifying host files is not scalable or manageable for a large number of VMs and bypasses DNS resolution entirely.