--- title: "Automated, Simplified DNS Troubleshooting for Kubernetes: Only in Calico Enterprise" source: "https://wordpress-1075849-4005834.cloudwaysapps.com/blog/automated-simplified-dns-troubleshooting-for-kubernetes-only-in-calico-enterprise/" --- [Company Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/company-blog/) # Automated, Simplified DNS Troubleshooting for Kubernetes: Only in Calico Enterprise By [John Armstrong](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/john-armstrong/) on Dec 16, 2020 • 5 min read The Domain Name System (DNS) is a naming system for computers, services, or other resources connected to the Internet or a private network. DNS translates domain names to the numerical IP addresses needed for locating and identifying computer services and devices. For decades It’s been an essential component of the Internet. It’s an essential part of Kubernetes as well, and is used to determine how workloads connect to [Kubernetes](http://kubernetes.io/) services as well as resources outside the cluster. DNS also happens to be a common source of outages and issues in Kubernetes clusters. When applications are not working as expected, the root cause is often DNS-related. However, debugging and troubleshooting DNS issues in Kubernetes environments is not a trivial task given the limited amount of information Kubernetes provides for DNS queries. Lacking the necessary visibility into the cluster to correlate a DNS query or reply with a specific workload, for example, you are left in the dark. Without Kubernetes context, you are unable to capture even the most fundamental information needed for troubleshooting, such as the type of DNS query (or reply) or the source of the query. ![DNS dashboard showing lack of Kubernetes context: queries, latency, and response codes by service are visible, but lack](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2020/12/DNS-dashboard.png) *Figure: The DNS Dashboard from Tigera helps Kubernetes teams more quickly confirm or eliminate DNS as the root cause for microservice and application connectivity issues, and eliminates a lot of manual, time-consuming introspection that would typically be required. No other vendor offers this automated capability.* #### **Introducing DNS Dashboard for Kubernetes** So how can you gain enough visibility into what is going on in DNS to quickly pin-point and efficiently troubleshoot issues? To solve this problem, our engineering team at Tigera has created the DNS Dashboard based on the DNS log data available in [Calico Enterprise](https://wordpress-1075849-4005834.cloudwaysapps.com/tigera-products/calico-commercial-editions/). It’s included in Calico Enterprise, is purpose-built for Kubernetes and provides an interactive GUI that enables you to: - View the total number of DNS queries and replies - Classify queries and replies by [record type](http://en.wikipedia.org/wiki/List_of_DNS_record_types), for example CNAME, A, AAAA, MX, SRV, etc. - Determine the source of a query and whether it is from a workload or service - Filter on troubleshooting scenarios - Automatically log all DNS queries and replies The DNS Dashboard helps Kubernetes teams more quickly confirm or eliminate DNS as the root cause for microservice and application connectivity issues, and eliminates a lot of manual, time-consuming introspection that would typically be required. No other vendor offers this automated capability. #### **Classify and View DNS Codes by Service** With the DNS Dashboard, you can view DNS codes by service. For example, if there is a Kubernetes service failure you can determine which service was queried, and can then further explore that service. Classifying queries and replies by service greatly simplifies the troubleshooting process and speeds problem resolution, immediately answering many of the questions that arise when troubleshooting connectivity issues: - Which DNS servers are in use? - Who is making the queries? - What types of queries are being made? - What replies are they receiving? Are there errors? - How many queries of a particular service are being made? - What is the minimum, maximum and average latency? - How much data was transmitted/received by a service or pod? #### **All DNS Activity is Automatically Logged** As a CNI, Calico Enterprise is in the unique position of being able to monitor traffic flows to look for DNS queries and replies, and is able to generate a special set of DNS log data for all Kubernetes activity. This capability is not offered in Kubernetes by default. External queries to domains outside the purview of Kubernetes are also logged by the DNS Dashboard. So if your pod is talking to the Internet or some other resource outside the cluster, you’ll know what domains it’s using and how many queries it’s making. Within the cluster there is a lot of noise, with services talking to other services. The DNS Dashboard cuts through the clutter and displays the Top 10 domains that are external to your cluster. #### **Security and Compliance Considerations** Application developers and DevOps aren’t the only teams that can benefit from the rich set of data that’s provided by DNS Dashboard and Calico Enterprise. Since all query data is logged, Security teams can apply Global Alerts in Calico Enterprise to define alerts that are automatically triggered based on certain criteria using the logged data. Security teams can answer the following questions: - What DNS servers are being queried? - How much data is being transferred and received by each pod? - How many queries are being received? Abnormal DNS behavior like an unusually high number of queries may indicate unauthorized data exfiltration via DNS and a flaw in your network policy such as a misconfiguration. NXDOMAINS in external requests, especially over TXT or CNAME requests, may suggest a DGA, infiltration or exfiltration attempt by an attacker. External queries to unknown domains may also represent suspicious behavior. In any of these use cases, the automation that drives the Calico Enterprise DNS Dashboard can quickly confirm or eliminate DNS as the root cause of the issue, thus speeding troubleshooting and problem resolution in Kubernetes environments. ————————————————————————————- [**Free Online Training**](https://wordpress-1075849-4005834.cloudwaysapps.com/events/) Access Live and On-Demand Kubernetes Training [**Calico Enterprise – Try Now**](https://www.calicocloud.io/) Kubernetes Networking, Security and Observability in Hybrid and Multi-Clouds [Products](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/products/) Add Tigera as a preferred source on Google to see more of our content in your search results. [![Add as a preferred source on Google](https://wordpress-1075849-4005834.cloudwaysapps.com/app/themes/tigera2021/dist/img/google-preferred-source-light.png)](https://www.google.com/preferences/source?q=tigera.io) ## Related posts [![The Rise of AI Agents and the Reinvention of Kubernetes: Ratan Tipirneni’s 2026 Outlook](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/12/The-Rise-of-AI-Agents-and-the-Reinvention-of-Kubernetes.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/2026-the-rise-of-ai-agents/) #### [The Rise of AI Agents and the Reinvention of Kubernetes: Ratan Tipirneni’s 2026 Outlook](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/2026-the-rise-of-ai-agents/) By [Tigera Team](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/marketingtigera-io/) on Dec 30, 2025 Prediction: The next evolution of Kubernetes is not about scale alone, but about intelligence, autonomy, and governance. As part of the article ‘AI and Enterprise Technology Predictions from Industry Experts for 2026′, published by Solutions... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/2026-the-rise-of-ai-agents/) [![How Istio Ambient Mode Delivers Real World Solutions](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/12/How-Istio-Ambient-Mode-Delivers-Real-World-Solutions.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/how-istio-ambient-mode-delivers-real-world-solutions/) [Technical Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/technical-blog/) #### [How Istio Ambient Mode Delivers Real World Solutions](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/how-istio-ambient-mode-delivers-real-world-solutions/) By [John Alexander](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/john-alexander/) on Dec 18, 2025 For years, platform teams have known what a service mesh can provide: strong workload identity, authorization, mutual TLS authentication and encryption, fine-grained traffic control, and deep observability across distributed systems. In theory, Istio checked all... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/how-istio-ambient-mode-delivers-real-world-solutions/) [![A Detailed Look at the Calico Ingress Gateway](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/11/Blog-A-Detailed-Look-at-the-Calico-Ingress-Gateway.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/a-detailed-look-at-the-calico-ingress-gateway/) #### [A Detailed Look at the Calico Ingress Gateway](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/a-detailed-look-at-the-calico-ingress-gateway/) By [John Alexander](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/john-alexander/) on Nov 20, 2025 The Kubernetes community recently announced that Ingress NGINX, one of the most widely used Ingress controllers, will be retired. This change means teams need to plan for a secure, modern, and future-proof alternative for managing... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/a-detailed-look-at-the-calico-ingress-gateway/)