Debug Kubernetes DNS ndots Latency

Measure resolver latency caused by the ndots search path and reduce unnecessary DNS queries for external names.

~30 minkubernetesdnsperformance

Task

Diagnose slow DNS lookups caused by ndots expansion for external hostnames.

When to use this

Outbound calls to an external API are slow because every DNS name goes through the cluster search path first.

Prerequisites

A pod with debugging tools
Access to resolv.conf
Permission to change pod DNS config

Steps

1. Inspect the resolver config and search path.

cat /etc/resolv.conf
# note ndots and search domains

Expected output: ndots determines how many search domains are tried before the absolute name.

2. Measure resolution latency with and without trailing dot.

time getent hosts api.external.com
time getent hosts api.external.com.

Expected output: The absolute name resolves faster, avoiding the search-path queries.

Troubleshooting

Problem

App cannot easily add trailing dots

Solution

Lower ndots in the pod DNS config or use FQDN forms in configuration.

Problem

In-cluster names break

Solution

Keep a workable ndots so service names still resolve via the search path.

Limitations

Tuning affects all lookups in the pod.
Does not cache negative responses.
Requires workload config changes.

What this recipe does

Diagnose slow DNS lookups caused by ndots expansion for external hostnames.

Outbound calls to an external API are slow because every DNS name goes through the cluster search path first.

Prerequisites

A pod with debugging tools
Access to resolv.conf
Permission to change pod DNS config

Procedure

Inspect the resolver config and search path.

cat /etc/resolv.conf
# note ndots and search domains

Expected result: ndots determines how many search domains are tried before the absolute name.

Measure resolution latency with and without trailing dot.

time getent hosts api.external.com
time getent hosts api.external.com.

Expected result: The absolute name resolves faster, avoiding the search-path queries.

How to confirm it worked

Run the commands above and confirm every expected result in order. If a step does not produce the stated output, use the troubleshooting notes before continuing. A passing run shows external name resolution skips unnecessary search-path queries and lookup latency drops measurably.

Troubleshooting

App cannot easily add trailing dots — Lower ndots in the pod DNS config or use FQDN forms in configuration.

In-cluster names break — Keep a workable ndots so service names still resolve via the search path.

Limitations

Tuning affects all lookups in the pod.
Does not cache negative responses.
Requires workload config changes.