> ## Documentation Index
> Fetch the complete documentation index at: https://docs.resolve.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# DNS Tap

[DNS Tap](https://dnstap.info/) is an open source protocol that streams DNS query and response logs to a TCP endpoint. Enable DNS Tap from the [Resolve Satellite](/resolve-satellite) to observe DNS resolution activity across your cluster in real time, without injecting anything into your application code.

***

## How ResolveAI Uses DNS Tap

The [Resolve Satellite](/resolve-satellite) uses DNS Tap to understand runtime relationships between services in your infrastructure.

Each time one pod resolves another (ex. `serviceA` queries `checkout.service.cluster.local`), the Satellite logs that DNS request. These query logs help Resolve:

* Build a live dependency graph of your architecture
* Surface upstream/downstream relationships during investigations
* Detect when a service goes down and others are affected

<Warning>
  This visibility is **critical** if you don’t have full APM or tracing coverage.
</Warning>

DNS Tap allows the Resolve Satellite to capture service-to-service DNS queries and build a runtime dependency map.

## Prerequisites

Install the [Resolve Satellite](/resolve-satellite) before setting up DNS Tap.

## 1. Get Cluster IP

<Tabs>
  <Tab title="Get Cluster IP">
    Copy the cluster IP of the Resolve Satellite.

    ```shell kubectl theme={null}
    kubectl get service <your satellite name> 
    ```
  </Tab>

  <Tab title="Set Static IP">
    Check [how to avoid cluster IP conflict in Kubernetes](https://kubernetes.io/docs/concepts/services-networking/cluster-ip-allocation/#avoid-ClusterIP-conflict) first.

    Then create a `resolve-values.yaml` file.

    ```yaml resolve-values.yaml theme={null}
    ingest:
      token: <your resolve satellite token>

    clusterName: <your cluster name>
    environment: <your environment>

    dnstap:
      enabled: true
      staticIP: <your resolve satellite IP> #e.g.:172.20.0.42
    ```

    <Warning>
      **Security Best Practice:** Never store credentials in plaintext in configuration files or source control.
      Always use Kubernetes secrets and encrypt etcd or use enterprise secret management systems.
      See [Secret Management](/secret-management) for detailed guidance.
    </Warning>

    Install the help chart using your new values file.
  </Tab>
</Tabs>

## 2. Configure CoreDNS

<Tabs>
  <Tab title="Kubernetes">
    Add this line to the CoreDNS ConfigMap Corefile to forward logs.

    ```yaml ConfigMap theme={null}
    dnstap tcp://<your resolve satellite IP>:4444 full
    ```

    For example, your ConfigMap will look something like this:

    ```yaml coredns config file example theme={null}
    apiVersion: v1
    kind: ConfigMap
    data:
      Corefile: |
        .:53 {
            errors
            health {
                lameduck 5s
            }
            ready
            kubernetes cluster.local in-addr.arpa ip6.arpa {
              pods insecure
              fallthrough in-addr.arpa ip6.arpa
            }
            dnstap tcp://<your resolve satellite IP>:4444 full
            prometheus :9153
            forward . /etc/resolv.conf
            cache 30
            loop
            reload
            loadbalance
        }
    ```

    ***

    ## Frequently Asked Questions

    <Accordion title="What is DNS Tap?">
      DNS Tap is an open source logging / monitoring technology that enables DNS servers to efficiently forward DNS logs to a TCP socket. The logs contain all DNS queries and responses made by the DNS server, as well as the requester’s IP and port. This DNS information can be used to determine which source IPs are requesting IPs for which other servers. Additional information on DNS Tap can be found at [https://dnstap.info/](https://dnstap.info/).
    </Accordion>

    <Accordion title="Does enabling DNS Tap impact performance?">
      No, the Satellite receives data via a **non-intrusive push model** from the DNS layer. It does not introduce any observable latency or load on your DNS servers or Kubernetes workloads.

      For deeper implementation specifics and performance characteristics, we recommend watching this [video overview](https://www.youtube.com/watch?v=rJ3vUUi_FG8).
    </Accordion>

    <Accordion title="What does a dependency map built from DNS Tap data look like?">
      The dependency map reflects **real traffic-driven service relationships** (not just declared ones). It includes:

      * **Calling services** and **target services**, identified via DNS requests.
      * Overlays with other metadata (e.g., from Kubernetes infrastructure data, tracing, etc.) to provide root cause context during investigations.

      Example: If `serviceA` makes a DNS request to `checkout.service.cluster.local`, and that resolves to a pod in the checkout service, ResolveAI will register a dependency between the two—enriching investigations when `serviceA` fails.
    </Accordion>
  </Tab>

  <Tab title="Amazon EKS">
    Configure CoreDNS either with the **AWS Console** or with **Terraform**.

    <Accordion title="Option 1: AWS Console">
      1. Open the Amazon EKS console
      2. Select your cluster from the list
      3. Navigate to the **Add-ons** tab
      4. Select the **CoreDNS** add-on and click **Edit**
      5. Scroll to **Optional configuration settings**
      6. In the **Configuration values** field, paste your existing Corefile config and add:

      ```text theme={null}
      dnstap tcp://<your resolve satellite IP>:4444 full
      ```

      <Info>
        Be sure to include your full, working Corefile. Do not remove or replace any required settings.
      </Info>

      Example Corefile:

      ```yaml coredns theme={null}
      corefile: |
        .:53 {
          errors
          health {
            lameduck 5s
          }
          ready
          kubernetes cluster.local in-addr.arpa ip6.arpa {
            pods insecure
            fallthrough in-addr.arpa ip6.arpa
          }
          dnstap tcp://<your resolve satellite IP>:4444 full
          prometheus :9153
          forward . /etc/resolv.conf
          cache 30
          loop
          reload
          loadbalance
        }
      ```

      For more detail, see the [AWS blog on advanced EKS add-on configuration](https://aws.amazon.com/blogs/containers/amazon-eks-add-ons-advanced-configuration/).
    </Accordion>

    <Accordion title="Option 2: Terraform">
      If you manage your EKS cluster using Terraform, you can configure the CoreDNS add-on with `jsonencode()` and a multi-line Corefile string.

      Example:

      ```text theme={null}
      module "eks" {
        source = "terraform-aws-modules/eks/aws"

        cluster_addons = {
          coredns = {
            addon_version = "<latest-version>"
            configuration_values = jsonencode({
              corefile = <<EOF
      .:53 {
        errors
        health {
          lameduck 5s
        }
        ready
        kubernetes cluster.local in-addr.arpa ip6.arpa {
          pods insecure
          fallthrough in-addr.arpa ip6.arpa
        }
        dnstap tcp://<your resolve satellite IP>:4444 full
        prometheus :9153
        forward . /etc/resolv.conf
        cache 30
        loop
        reload
        loadbalance
      }
      EOF
            })
          }
        }
      }
      ```

      This method ensures consistent config across environments and supports GitOps workflows.
    </Accordion>
  </Tab>

  <Tab title="Azure AKS">
    Create and save a **coredns-custom.yaml** file with the following configuration:

    ```yaml coredns-custom.yaml theme={null}
    apiVersion: v1
    kind: ConfigMap
    metadata:
      name: coredns-custom
    data:
      dnstap.override: |
        dnstap tcp://<your resolve satellite IP>:4444 full
    ```

    Additional information on customizing CoreDNS in AKS  can be found in [Azure documentation.](https://learn.microsoft.com/en-us/azure/aks/coredns-custom)
  </Tab>
</Tabs>