Debugging DNS Resolution [page]deterministic

This page provides hints on diagnosing DNS problems.

##

Your cluster must be configured to use the CoreDNS [addon](#gloss:addons) or its precursor, kube-dns.

### Create a simple Pod to use as a test environment

> Note: This example creates a pod in the `default` namespace. DNS name resolution for services depends on the namespace of the pod. For more information, review [DNS for Services and Pods](/docs/concepts/services-networking/dns-pod-service/#what-things-get-dns-names).

Use that manifest to create a Pod:

```shell kubectl apply -f https://k8s.io/examples/admin/dns/dnsutils.yaml ``` ``` pod/dnsutils created ``` …and verify its status: ```shell kubectl get pods dnsutils ``` ``` NAME READY STATUS RESTARTS AGE dnsutils 1/1 Running 0 <some-time> ```

Once that Pod is running, you can exec `nslookup` in that environment. If you see something like the following, DNS is working correctly.

```shell kubectl exec -i -t dnsutils -- nslookup kubernetes.default ``` ``` Server: 10.0.0.10 Address 1: 10.0.0.10

Name: kubernetes.default Address 1: 10.0.0.1 ```

If the `nslookup` command fails, check the following:

### Check the local DNS configuration first

Take a look inside the resolv.conf file. (See [Customizing DNS Service](/docs/tasks/administer-cluster/dns-custom-nameservers) and [Known issues](#known-issues) below for more information)

```shell kubectl exec -ti dnsutils -- cat /etc/resolv.conf ```

Verify that the search path and name server are set up like the following (note that search path may vary for different cloud providers):

``` search default.svc.cluster.local svc.cluster.local cluster.local google.internal c.gce_project_id.internal nameserver 10.0.0.10 options ndots:5 ```

Errors such as the following indicate a problem with the CoreDNS (or kube-dns) add-on or with associated Services:

```shell kubectl exec -i -t dnsutils -- nslookup kubernetes.default ``` ``` Server: 10.0.0.10 Address 1: 10.0.0.10

nslookup: can't resolve 'kubernetes.default' ```

or

```shell kubectl exec -i -t dnsutils -- nslookup kubernetes.default ``` ``` Server: 10.0.0.10 Address 1: 10.0.0.10 kube-dns.kube-system.svc.cluster.local

nslookup: can't resolve 'kubernetes.default' ```

### Check if the DNS pod is running

Use the `kubectl get pods` command to verify that the DNS pod is running.

```shell kubectl get pods --namespace=kube-system -l k8s-app=kube-dns ``` ``` NAME READY STATUS RESTARTS AGE ... coredns-7b96bf9f76-5hsxb 1/1 Running 0 1h coredns-7b96bf9f76-mvmmt 1/1 Running 0 1h ... ```

> Note: The value for label `k8s-app` is `kube-dns` for both CoreDNS and kube-dns deployments.

If you see that no CoreDNS Pod is running or that the Pod has failed/completed, the DNS add-on may not be deployed by default in your current environment and you will have to deploy it manually.

### Check for errors in the DNS pod

Use the `kubectl logs` command to see logs for the DNS containers.

For CoreDNS: ```shell kubectl logs --namespace=kube-system -l k8s-app=kube-dns ```

Here is an example of a healthy CoreDNS log:

``` .:53 2018/08/15 14:37:17 [INFO] CoreDNS-1.2.2 2018/08/15 14:37:17 [INFO] linux/amd64, go1.10.3, 2e322f6 CoreDNS-1.2.2 linux/amd64, go1.10.3, 2e322f6 2018/08/15 14:37:17 [INFO] plugin/reload: Running configuration MD5 = 24e6c59e83ce706f07bcc82c31b1ea1c ```

See if there are any suspicious or unexpected messages in the logs.

### Is DNS service up?

Verify that the DNS service is up by using the `kubectl get service` command.

```shell kubectl get svc --namespace=kube-system ``` ``` NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE ... kube-dns ClusterIP 10.0.0.10 <none> 53/UDP,53/TCP 1h ... ```

> Note: The service name is `kube-dns` for both CoreDNS and kube-dns deployments.

If you have created the Service or in the case it …(trimmed)