How to fix nslookup: can't resolve service in Kubernetes

KubernetesINTERMEDIATEHIGHUpdated Dec 6, 2025· 212 views

Pod or service DNS lookups fail because CoreDNS is not running, network policies block DNS traffic (UDP/53), or the service doesn't exist. Applications cannot reach services by hostname, requiring fully qualified domain names or direct IP addresses as workarounds. Fix by verifying CoreDNS is running, checking network policies, and ensuring proper DNS configuration.

Quick fix

Fixes nslookup: can't resolve service

kubectl get pods -n kube-system | grep coredns
kubectl describe deployment coredns -n kube-system
kubectl logs -n kube-system -l k8s-app=kube-dns
  1. Verify CoreDNS is running
  2. Test DNS from inside a pod
  3. Check for network policies blocking DNS
  4. Verify /etc/resolv.conf inside pod
kubernetes — error
kubectl get pods -n kube-system | grep coredns
kubectl describe deployment coredns -n kube-system
kubectl logs -n kube-system -l k8s-app=kube-dns
nslookup: can't resolve service

What this error means

Kubernetes uses CoreDNS to resolve service names to cluster IPs. When DNS resolution fails, pods cannot reach services by hostname (e.g., myservice or myservice.namespace). This happens when CoreDNS crashes, network policies block UDP/53, Alpine Linux containers lack DNS tools, or the service name is wrong. DNS is critical for service discovery in Kubernetes.

Typical symptoms

  • Connection timeout when reaching service by hostname
  • nslookup or dig commands fail inside pod
  • "Name or service not known" errors
  • Works with direct IP but fails with DNS name
  • Some namespaces work, others don't (network policy issue)
  • Application logs show DNS timeouts

Common causes

  1. CoreDNS pod crashed, evicted, or not running
  2. Network policy blocking DNS traffic (UDP/53)
  3. DNS queries routed to wrong nameserver
  4. Service doesn't exist or wrong namespace
  5. Alpine Linux image missing DNS utilities (nslookup, getent)
  6. Node DNS configuration inherited incorrectly
  7. CoreDNS ConfigMap misconfigured

How to fix "nslookup: can't resolve service"

1Verify CoreDNS is running

Check DNS pods in kube-system namespace:

bash
kubectl get pods -n kube-system | grep coredns
kubectl describe deployment coredns -n kube-system
kubectl logs -n kube-system -l k8s-app=kube-dns

If not running or restarting, check resource limits and node disk space.

2Test DNS from inside a pod

Run an interactive debug pod and test DNS:

bash
kubectl run -it --rm debug --image=ubuntu --restart=Never -- bash
apt-get update && apt-get install -y dnsutils
nslookup kubernetes.default
nslookup myservice.default.svc.cluster.local

If nslookup fails, DNS is misconfigured. If it works, the issue is application-level.

3Check for network policies blocking DNS

Network policies may restrict UDP/53 (DNS):

bash
kubectl get networkpolicies -A
kubectl describe networkpolicy <policy-name> -n <namespace>

If policies exist, ensure they allow UDP to port 53 for CoreDNS pods in kube-system. Example allow rule:

yaml
ingress:
- protocol: UDP
  ports:
  - port: 53
from:
- namespaceSelector: {}
4Verify /etc/resolv.conf inside pod

Check pod's DNS configuration:

bash
kubectl exec -it <pod-name> -n <namespace> -- cat /etc/resolv.conf

Should show:

bash
nameserver 10.96.0.10  # CoreDNS service IP (default, varies by cluster)
search default.svc.cluster.local svc.cluster.local cluster.local

If missing or incorrect, restart pod or check dnsPolicy in pod spec.

5Check CoreDNS ConfigMap

Inspect CoreDNS configuration:

bash
kubectl get configmap coredns -n kube-system -o yaml

Look for Corefile section. Ensure zones are configured correctly. If using custom DNS, verify forwarders are correct and accessible.

6For Alpine Linux, install DNS tools

Alpine minimal images lack DNS utilities:

bash
kubectl exec <pod-name> -n <namespace> -- apk add --no-cache bind-tools
kubectl exec <pod-name> -n <namespace> -- nslookup myservice

Or use a base image with dnsutils (ubuntu, debian, or node:alpine with libc).

7Restart CoreDNS to clear stale state

Force CoreDNS pods to restart:

bash
kubectl rollout restart deployment/coredns -n kube-system
kubectl get pods -n kube-system -w | grep coredns

Wait for pods to return to Running state. This clears cache and reconnects to upstream DNS.

Advanced notes

CoreDNS uses a cache (TTL-based); stale entries may persist. For external DNS forwarders, ensure they are reachable and responsive. In air-gapped environments, configure local DNS. Some CNI plugins (Weave, Flannel) provide DNS; verify compatibility. Custom CoreDNS plugins can interfere with resolution; check Corefile plugins list. For production, monitor CoreDNS CPU/memory; high load causes slow responses and timeout-like behavior.

Frequently asked questions

What does "nslookup: can't resolve service" mean?
Kubernetes uses CoreDNS to resolve service names to cluster IPs. namespace). This happens when CoreDNS crashes, network policies block UDP/53, Alpine Linux containers lack DNS tools, or the service name is wrong.
How do I fix "nslookup: can't resolve service"?
Pod or service DNS lookups fail because CoreDNS is not running, network policies block DNS traffic (UDP/53), or the service doesn't exist. Applications cannot reach services by hostname, requiring fully qualified domain names or direct IP addresses as workarounds. Fix by verifying CoreDNS is running, checking network policies, and ensuring proper DNS configuration.
What causes "nslookup: can't resolve service"?
CoreDNS pod crashed, evicted, or not running Network policy blocking DNS traffic (UDP/53) DNS queries routed to wrong nameserver
Is the "nslookup: can't resolve service" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading