DnsHighServFailRate #

Meaning #

The Blocky DNS resolver is returning more than 1% SERVFAIL responses for 10 minutes. This indicates that upstream resolvers are failing or the configuration is incorrect.

Impact #

Clients querying DNS are experiencing resolution failures. This can cause application timeouts, failed service discovery, and degraded connectivity across the cluster.

Diagnosis #

Check Blocky pod status:

kubectl get pods -n dns -l app.kubernetes.io/name=resolver

Check Blocky logs for SERVFAIL responses:

kubectl logs -n dns -l app.kubernetes.io/name=resolver --tail=100 | grep -i SERVFAIL

Verify Blocky configuration:

kubectl get configmap -n dns blocky-config -o yaml

Test DNS resolution directly against Blocky:

kubectl exec -it $(kubectl get pods -n dns -l app.kubernetes.io/name=resolver -o name | head -1) -- nslookup example.com 127.0.0.1

Mitigation #

If upstream resolvers are down, switch to alternative resolvers in the Blocky configuration and restart the pods:

kubectl rollout restart deployment -n dns -l app.kubernetes.io/name=resolver

Check network policies to ensure Blocky can reach upstream DNS servers.