Container Service for Kubernetes:Use ACK CoreDNS DNSTAP Analyser to diagnose DNS resolution errors

How it works

CoreDNS includes a built-in dnstap plugin that streams structured binary logs of all DNS queries and responses. ACK CoreDNS DNSTAP Analyser receives these dnstap messages, correlates them into sessions, and outputs a diagnostic summary for each session. Each summary includes:

• Status -- Whether the resolution succeeded, failed, or experienced message loss

• BitMap -- Which legs of the DNS path were observed (client → CoreDNS → upstream)

• Messages -- The raw DNS query and response content in JSON format

Step 1: Install ACK CoreDNS DNSTAP Analyser

1. Log on to the ACK console.

2. In the left-side navigation pane, choose Marketplace > Marketplace.

3. On the App Catalog page, search for ack-coredns-dnstap-analyser and click it in the results.

4. Click Deploy.

5. Select a cluster and namespace, then click Next. Configure the parameters based on your requirements and click OK.

Step 2: Configure the dnstap plugin in CoreDNS

After you install ACK CoreDNS DNSTAP Analyser, configure CoreDNS to forward dnstap messages to it.

1. Get the ClusterIP of the ACK CoreDNS DNSTAP Analyser service: Note the CLUSTER-IP value. The following steps use 172.21.0.10 as an example.

      kubectl -n kube-system get svc dnstap-analyser

2. Edit the CoreDNS ConfigMap:

      kubectl -n kube-system edit cm coredns -o yaml

3. Add the dnstap directive to the Corefile. Place it after the ready directive and before the kubernetes block: The full parameter captures the complete wire-format DNS message. Port 6000 is the default listening port for ACK CoreDNS DNSTAP Analyser.

      Corefile: |
          .:53 {
              # ... existing directives ...
              ready
   
              # Forward dnstap messages to ACK CoreDNS DNSTAP Analyser.
              # Replace 172.21.0.10 with the actual ClusterIP from Step 1.
              dnstap tcp://172.21.0.10:6000 full
   
              kubernetes cluster.local in-addr.arpa ip6.arpa {
              # ... existing configuration ...
              }
              # ... existing directives ...
              reload
              loadbalance
          }

4. Verify that CoreDNS reloads successfully. First, list the CoreDNS pods: Expected output:

      kubectl -n kube-system get pod | grep coredns

      coredns-7d56l         1/1     Running   0          30m
      coredns-s7m2t         1/1     Running   0          30m

5. Check the logs of a CoreDNS pod. Replace <coredns-pod> with a pod name from the previous output: Wait approximately one minute. If the following output appears with no errors, the configuration change is active:

      kubectl -n kube-system logs -f --tail=500 <coredns-pod>

      [INFO] Reloading complete

Step 3: View ACK CoreDNS DNSTAP Analyser logs

1. List the ACK CoreDNS DNSTAP Analyser pods: Expected output:

      kubectl -n kube-system get pod | grep dnstap-analyser

      dnstap-analyser-bbdf879-g****         1/1     Running   0          30m

2. View the analyser logs. Replace <analyser-pod> with the pod name from the previous output:

      kubectl -n kube-system logs -f <analyser-pod>

Step 4: Interpret the diagnostic output

Each line in the ACK CoreDNS DNSTAP Analyser log represents one DNS session -- the full set of requests and responses exchanged among a client, CoreDNS, and an upstream DNS server for a single query.

Step 5: (Optional) Uninstall ACK CoreDNS DNSTAP Analyser

After you identify the root cause, uninstall ACK CoreDNS DNSTAP Analyser to avoid unnecessary costs.