DNS Tap - ResolveAI

DNS Tap is an open source protocol that streams DNS query and response logs to a TCP endpoint. Enable DNS Tap from the Resolve Satellite to observe DNS resolution activity across your cluster in real time, without injecting anything into your application code.

How ResolveAI Uses DNS Tap

The Resolve Satellite uses DNS Tap to understand runtime relationships between services in your infrastructure. Each time one pod resolves another (ex. serviceA queries checkout.service.cluster.local), the Satellite logs that DNS request. These query logs help Resolve:

Build a live dependency graph of your architecture
Surface upstream/downstream relationships during investigations
Detect when a service goes down and others are affected

This visibility is critical if you don’t have full APM or tracing coverage.

DNS Tap allows the Resolve Satellite to capture service-to-service DNS queries and build a runtime dependency map.

Prerequisites

Install the Resolve Satellite before setting up DNS Tap.

1. Get Cluster IP

Get Cluster IP
Set Static IP

Copy the cluster IP of the Resolve Satellite.

kubectl

kubectl get service <your satellite name>

Check how to avoid cluster IP conflict in Kubernetes first.Then create a resolve-values.yaml file.

resolve-values.yaml

ingest:
  token: <your resolve satellite token>

clusterName: <your cluster name>
environment: <your environment>

dnstap:
  enabled: true
  staticIP: <your resolve satellite IP> #e.g.:172.20.0.42

Security Best Practice: Never store credentials in plaintext in configuration files or source control. Always use Kubernetes secrets and encrypt etcd or use enterprise secret management systems. See Secret Management for detailed guidance.

Install the help chart using your new values file.

2. Configure CoreDNS

Kubernetes
Amazon EKS
Azure AKS

Add this line to the CoreDNS ConfigMap Corefile to forward logs.

ConfigMap

dnstap tcp://<your resolve satellite IP>:4444 full

For example, your ConfigMap will look something like this:

coredns config file example

apiVersion: v1
kind: ConfigMap
data:
  Corefile: |
    .:53 {
        errors
        health {
            lameduck 5s
        }
        ready
        kubernetes cluster.local in-addr.arpa ip6.arpa {
          pods insecure
          fallthrough in-addr.arpa ip6.arpa
        }
        dnstap tcp://<your resolve satellite IP>:4444 full
        prometheus :9153
        forward . /etc/resolv.conf
        cache 30
        loop
        reload
        loadbalance
    }

Frequently Asked Questions

What is DNS Tap?

DNS Tap is an open source logging / monitoring technology that enables DNS servers to efficiently forward DNS logs to a TCP socket. The logs contain all DNS queries and responses made by the DNS server, as well as the requester’s IP and port. This DNS information can be used to determine which source IPs are requesting IPs for which other servers. Additional information on DNS Tap can be found at https://dnstap.info/.

Does enabling DNS Tap impact performance?

No, the Satellite receives data via a non-intrusive push model from the DNS layer. It does not introduce any observable latency or load on your DNS servers or Kubernetes workloads.For deeper implementation specifics and performance characteristics, we recommend watching this video overview.

What does a dependency map built from DNS Tap data look like?

The dependency map reflects real traffic-driven service relationships (not just declared ones). It includes:

Calling services and target services, identified via DNS requests.
Overlays with other metadata (e.g., from Kubernetes infrastructure data, tracing, etc.) to provide root cause context during investigations.

Example: If serviceA makes a DNS request to checkout.service.cluster.local, and that resolves to a pod in the checkout service, ResolveAI will register a dependency between the two—enriching investigations when serviceA fails.

Configure CoreDNS either with the AWS Console or with Terraform.

Option 1: AWS Console

Open the Amazon EKS console
Select your cluster from the list
Navigate to the Add-ons tab
Select the CoreDNS add-on and click Edit
Scroll to Optional configuration settings
In the Configuration values field, paste your existing Corefile config and add:

dnstap tcp://<your resolve satellite IP>:4444 full

Be sure to include your full, working Corefile. Do not remove or replace any required settings.

Example Corefile:

coredns

corefile: |
  .:53 {
    errors
    health {
      lameduck 5s
    }
    ready
    kubernetes cluster.local in-addr.arpa ip6.arpa {
      pods insecure
      fallthrough in-addr.arpa ip6.arpa
    }
    dnstap tcp://<your resolve satellite IP>:4444 full
    prometheus :9153
    forward . /etc/resolv.conf
    cache 30
    loop
    reload
    loadbalance
  }

For more detail, see the AWS blog on advanced EKS add-on configuration.

Option 2: Terraform

If you manage your EKS cluster using Terraform, you can configure the CoreDNS add-on with jsonencode() and a multi-line Corefile string.Example:

module "eks" {
  source = "terraform-aws-modules/eks/aws"

  cluster_addons = {
    coredns = {
      addon_version = "<latest-version>"
      configuration_values = jsonencode({
        corefile = <<EOF
.:53 {
  errors
  health {
    lameduck 5s
  }
  ready
  kubernetes cluster.local in-addr.arpa ip6.arpa {
    pods insecure
    fallthrough in-addr.arpa ip6.arpa
  }
  dnstap tcp://<your resolve satellite IP>:4444 full
  prometheus :9153
  forward . /etc/resolv.conf
  cache 30
  loop
  reload
  loadbalance
}
EOF
      })
    }
  }
}

This method ensures consistent config across environments and supports GitOps workflows.

Create and save a coredns-custom.yaml file with the following configuration:

coredns-custom.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: coredns-custom
data:
  dnstap.override: |
    dnstap tcp://<your resolve satellite IP>:4444 full

Additional information on customizing CoreDNS in AKS can be found in Azure documentation.

​How ResolveAI Uses DNS Tap

​Prerequisites

​1. Get Cluster IP

​2. Configure CoreDNS

​Frequently Asked Questions

How ResolveAI Uses DNS Tap

Prerequisites

1. Get Cluster IP

2. Configure CoreDNS

Frequently Asked Questions