DNS is the backbone of service discovery in Kubernetes. Every Service and Pod gets a DNS name, and CoreDNS handles resolution within the cluster. Understanding DNS naming, record types, and debugging is essential for production troubleshooting — DNS issues are one of the top 3 causes of connectivity failures.

1. CoreDNS Architecture

CoreDNS is deployed as a Deployment + Service in kube-system. It watches the API server for Services and Endpoints and serves DNS records accordingly.

How Pods Find CoreDNS

The kubelet configures every Pod's /etc/resolv.conf to point at the CoreDNS Service IP:

# Inside any Pod:
cat /etc/resolv.conf
nameserver 10.96.0.10                          # CoreDNS ClusterIP
search default.svc.cluster.local svc.cluster.local cluster.local
options ndots:5

2. DNS Record Types

Service DNS Names

# Full format:
{service-name}.{namespace}.svc.{cluster-domain}

# Examples:
web.default.svc.cluster.local          # Service "web" in "default" namespace
postgres.database.svc.cluster.local    # Service "postgres" in "database" namespace

Short Names & Search Domains

# From a Pod in the "default" namespace:
curl web              # → web.default.svc.cluster.local (same namespace)
curl web.database     # → web.database.svc.cluster.local (different namespace)
curl web.database.svc # → web.database.svc.cluster.local

# The search path in resolv.conf makes these work:
# search default.svc.cluster.local svc.cluster.local cluster.local

Record Types by Service Type

SRV Records

# Format: _port-name._protocol.service.namespace.svc.cluster.local
# Example for Service "web" with port named "http":
dig SRV _http._tcp.web.default.svc.cluster.local

# Returns:
# _http._tcp.web.default.svc.cluster.local. 30 IN SRV 0 100 80 web.default.svc.cluster.local.
#                                                        priority weight port target

# SRV records are useful for service meshes and clients that 
# need to discover both the port AND the address dynamically

Pod DNS Records

# Pods don't normally get DNS records unless:

# 1. Via a headless Service + StatefulSet:
#    postgres-0.postgres-headless.default.svc.cluster.local

# 2. Via Pod spec with hostname and subdomain:
spec:
  hostname: my-pod
  subdomain: my-subdomain     # must match a headless Service name
# Creates: my-pod.my-subdomain.default.svc.cluster.local

# 3. Pod A-record (enabled by default, rarely used):
#    10-244-1-5.default.pod.cluster.local  (dashes replace dots in IP)

3. CoreDNS Configuration

CoreDNS is configured via a ConfigMap in kube-system:

kubectl get configmap coredns -n kube-system -o yaml

Default Corefile

.:53 {
    errors                          # Log errors
    health {                        # Health check endpoint (/health)
        lameduck 5s
    }
    ready                           # Readiness endpoint (/ready)
    kubernetes cluster.local in-addr.arpa ip6.arpa {  # K8s plugin
        pods insecure               # Enable Pod A records
        fallthrough in-addr.arpa ip6.arpa
        ttl 30                      # DNS TTL for records
    }
    prometheus :9153                # Metrics endpoint
    forward . /etc/resolv.conf {    # Forward non-cluster queries upstream
        max_concurrent 1000
    }
    cache 30                        # Cache responses for 30s
    loop                            # Detect forwarding loops
    reload                          # Auto-reload Corefile on change
    loadbalance                     # Round-robin A records
}

Common Customizations

Stub Domains — Forward specific zones to custom DNS

# Add to Corefile: forward queries for .consul to Consul DNS
consul.local:53 {
    errors
    cache 30
    forward . 10.0.0.100:8600      # Consul DNS agent
}
# Now Pods can resolve: my-service.service.consul.local

Custom Upstream DNS

# Replace /etc/resolv.conf forwarding with specific servers:
forward . 8.8.8.8 8.8.4.4 {
    max_concurrent 1000
}

Hosts Plugin — Static entries

# Add custom host entries (like /etc/hosts):
hosts {
    10.0.0.50 legacy-db.company.internal
    fallthrough
}

4. Pod DNS Policies

Control how a Pod's /etc/resolv.conf is generated:

Custom DNS Config

spec:
  dnsPolicy: None
  dnsConfig:
    nameservers:
      - 10.0.0.100              # Custom DNS
    searches:
      - mycompany.internal
      - svc.cluster.local
    options:
      - name: ndots
        value: "2"              # Reduce ndots for fewer search queries

5. Debugging DNS Issues

# Test DNS resolution from a debug Pod:
kubectl run dnstest --image=busybox:1.36 -it --rm -- nslookup web.default.svc.cluster.local

# More detailed (with dig):
kubectl run dnstest --image=nicolaka/netshoot -it --rm -- \
  dig web.default.svc.cluster.local

# Check if CoreDNS is running:
kubectl get pods -n kube-system -l k8s-app=kube-dns

# Check CoreDNS logs for errors:
kubectl logs -n kube-system -l k8s-app=kube-dns --tail=50

# Verify the kube-dns Service exists:
kubectl get svc kube-dns -n kube-system
# Should show ClusterIP 10.96.0.10

# Check Pod's resolv.conf:
kubectl exec my-pod -- cat /etc/resolv.conf

Common DNS Issues

Summary

consul:53 {
    errors
    cache 30
    forward . 10.0.0.100:8600
}