We rolled out a default-deny egress NetworkPolicy to a namespace and every pod immediately failed to resolve names, including other services in the same namespace. Policies select pods, DNS runs in kube-system, and the namespace selector needed the right label. The policy set we use now and how we test it.
Calls from our pods to a payment API had 40 to 200 ms of unexplained latency and CoreDNS was the busiest workload in the cluster. Every lookup of api.payments.example went through five search domains first because of ndots:5. FQDNs with a trailing dot and a lower ndots fixed both.
A practitioner's reading of AWS's official summary of the October 19-20, 2025 us-east-1 disruption: a race in DynamoDB's DNS automation left an empty record, and recovery cascaded through EC2, NLB and Lambda. What happened per the report, and what we changed.
When a service cannot reach an API, guessing wastes hours. We follow the packet: name resolution, route, TCP handshake, TLS, then HTTP, with one or two commands per layer that each prove or eliminate a whole class of causes.
We moved our app to a new host and switched DNS on a Saturday. A day later almost half of requests still reached the old server. A 24-hour TTL, a nameserver change with a 48-hour delegation TTL and an old zone left online kept stale answers alive. This is the postmortem.
An overview of Cloudflare's Free, Pro, Business and Enterprise plans, then a practical guide to everything the free tier offers a small team: DNS, CDN, Universal SSL, DDoS protection, WAF managed rules, rate limiting, Tunnel, Zero Trust, Pages, Workers, R2 and Turnstile, with a setup order.
About one request in two hundred from our pods took exactly five seconds longer than normal. The delay was in DNS: parallel A and AAAA lookups over UDP raced in the kernel's conntrack table and one reply was dropped, so glibc waited its 5-second timeout. How we proved it and fixed it with NodeLocal DNSCache.