When a Kubernetes Pod cannot resolve a name, first separate cluster Service lookups from external DNS lookups. If kubernetes.default resolves but an external hostname fails, investigate the upstream resolver path before changing application settings.
This guide applies to clusters using CoreDNS. You need kubectl access, permission to inspect kube-system, and a Pod with DNS tools. Service names, namespaces, labels, and the cluster domain can differ; the examples below use the common kube-dns Service and cluster.local domain.
On this page
Test from the affected namespace
Use an existing diagnostic Pod in the same namespace as the failing workload. If none is available, review the official dnsutils manifest before creating one. A newly created Pod can still have different NetworkPolicy permissions, so compare its labels and DNS settings with the application.
NAMESPACE=default
POD=dnsutils
kubectl -n "$NAMESPACE" exec "$POD" -- cat /etc/resolv.conf
kubectl -n "$NAMESPACE" exec "$POD" -- nslookup kubernetes.default
kubectl -n "$NAMESPACE" exec "$POD" -- nslookup example.comReplace default and dnsutils with your namespace and Pod name. The resolver file shows the nameserver and search domains actually used by that Pod. A short Service name resolves relative to the Pod namespace; use SERVICE.NAMESPACE.svc.CLUSTER_DOMAIN when testing across namespaces.
| Observation | Next check |
|---|---|
| Both lookups time out | Pod resolver address, DNS Service endpoints, and the network path to DNS. |
| Cluster lookup works; external lookup fails | CoreDNS forwarding configuration and access to upstream resolvers. |
| Only one Service name fails | Service spelling, namespace, cluster domain, and Service endpoints. |
| Only some workloads fail | Pod DNS policy, namespace, NetworkPolicy selection, and node placement. |
Inspect the DNS Service and its backends
kubectl -n kube-system get pods -l k8s-app=kube-dns -o wide
kubectl -n kube-system get service kube-dns -o wide
kubectl -n kube-system get endpointslices -l kubernetes.io/service-name=kube-dnsCompare the Service ClusterIP with the Pod nameserver. Clusters with NodeLocal DNSCache can intentionally use a local cache address instead. If the DNS Pods are not Ready or the EndpointSlices contain no ready backends, inspect the deployment, Pod events, and Service selector. These commands assume the usual labels; check the actual deployment if they return no resources.
Read CoreDNS logs and configuration
kubectl -n kube-system logs -l k8s-app=kube-dns --all-containers=true --tail=100
kubectl -n kube-system get configmap coredns -o yamlCorrelate errors with the failed query time. Check the Corefile for the configured cluster zone and the forward destination. If forwarding uses /etc/resolv.conf, inspect the resolver configuration seen by CoreDNS. A host stub resolver can create a forwarding loop in some configurations; follow the Kubernetes guidance for your node resolver and kubelet configuration.
Avoid restarting DNS before collecting evidence. A restart can hide an intermittent failure while leaving the underlying resolver or networking issue in place. Back up the current ConfigMap before making a reviewed change.
Check DNS policy and network access
kubectl -n "$NAMESPACE" get pod "$POD" -o yaml
kubectl -n "$NAMESPACE" get networkpolicy
kubectl -n kube-system get networkpolicyInspect dnsPolicy, dnsConfig, and hostNetwork on the failing Pod. A workload using the host network may need ClusterFirstWithHostNet for cluster DNS behavior. When policies apply, inspect both workload egress and DNS Pod ingress. DNS can use UDP and TCP port 53; permitting only UDP can leave some queries failing.
For external names, also trace traffic from CoreDNS to its upstream resolver. If failures occur only on one node, compare the CNI, Service routing, and node firewall with a working node. Change one confirmed cause, then repeat the same lookups from the original workload.
References checked on October 23, 2026. This is a documentation-based diagnostic guide; the commands were reviewed, but no live cluster outage was reproduced for this article.
References
Kubernetes: debugging DNS resolution
