Applications call `checkout`; CoreDNS and the search path do the rest.

CoreDNS runs inside the cluster as a Deployment and answers for cluster.local. Every Pod's resolver is pointed at it.

`ndots: 5` latency

A name with fewer than 5 dots, such as api.stripe.com, is tried against every search domain first. Lower ndots or use trailing-dot names for chatty external calls.

`dnsPolicy: Default` trap

Despite the name it is not the default. It bypasses CoreDNS, so .svc.cluster.local names fail while the internet works.

Quick test

kubectl run -it --rm dbg --image=nicolaka/netshoot -- nslookup checkout.shop

CoreDNS turns names into Service IPs

Applications refer to Services by name. CoreDNS, running as a Deployment in kube-system, is the cluster's DNS server for the cluster.local domain. Each Pod's /etc/resolv.conf points at it and contains a search path, so a short name such as checkout is expanded to checkout.shop.svc.cluster.local using the Pod's own namespace. A name in another namespace needs the namespace: checkout.payments.

Reveal the four steps: the app asks for checkout, the resolver tries the search path, CoreDNS answers with the Service's ClusterIP, and kube-proxy's rules route that virtual IP to one ready Pod.

Two settings cause real incidents. ndots defaults to 5, so any name with fewer than five dots, including ordinary external names like api.stripe.com, is first tried against each internal search domain, producing several failed lookups before the real one. For latency-sensitive workloads that call many external APIs, lower ndots or use fully qualified names with a trailing dot. And dnsPolicy: Default is misleadingly named: it uses the node's resolver and bypasses CoreDNS, so internal names break; the real default is ClusterFirst.

On large clusters CoreDNS load can become significant. Node-local DNS caching (NodeLocal DNSCache) is a common mitigation, and GKE and EKS offer managed variants.

Applications call checkout; CoreDNS and the search path do the rest.

ndots: 5 latency

dnsPolicy: Default trap

Quick test

Applications call `checkout`; CoreDNS and the search path do the rest.

`ndots: 5` latency

`dnsPolicy: Default` trap