Skip to content

DNS Resolution Failures for External Hostnames

Symptom

Pods can resolve cluster.local service names but fail to resolve external hostnames such as microsoft.com, private corporate domains, or partner-managed suffixes.

Possible Causes

  • VNet DNS points to the wrong upstream resolver.
  • A custom DNS server is unavailable or cannot resolve the requested domain.
  • A CoreDNS conditional forwarder points the suffix at the wrong target.
  • Node-local DNS settings were changed in the VNet but never applied to AKS nodes.
  • Network policy blocks DNS egress.

Diagnosis Steps

flowchart TD
    A[External hostnames fail] --> B[Confirm cluster-local names still resolve]
    B --> C[Inspect CoreDNS or LocalDNS forward path]
    C --> D{Default upstream issue or domain-specific issue?}
    D -->|Default upstream| E[Review VNet DNS and custom DNS server health]
    D -->|Domain specific| F[Review conditional forward rules and stub domains]
    E --> G[Reimage nodes if DNS settings changed only at VNet layer]
    F --> G

  1. Confirm internal cluster DNS still works.

    kubectl exec <pod-name> \
    --namespace "$NAMESPACE" \
    -- nslookup kubernetes.default

  2. Test the failing external hostname from the same pod.

    kubectl exec <pod-name> \
    --namespace "$NAMESPACE" \
    -- nslookup example.com

  3. Inspect current CoreDNS customizations.

    kubectl get configmaps \
    --namespace kube-system \
    coredns-custom \
    --output yaml

  4. If LocalDNS is enabled, review the applied node-pool configuration and whether the suffix is expected to use VnetDNS or ClusterCoreDNS.

  5. Ask whether VNet DNS servers were changed recently in Azure. If yes, verify whether the node pool was reimaged afterward.

Resolution

  • Correct bad CoreDNS conditional forwarders or stub-domain rules.
  • Restore availability on the upstream custom DNS resolver.
  • Reimage the AKS node pool when VNet DNS server settings changed outside the AKS resource provider path.
  • Add explicit DNS egress allow rules if namespace policy is blocking the resolver path.

Prevention

  • Document which domains resolve through default VNet DNS and which use conditional forwarding.
  • Treat VNet DNS changes as AKS changes that require node-pool rollout planning.
  • Keep test queries for both cluster.local and external domains in post-change validation.

See Also

Sources