# Alpine-based pods fail DNS lookups after a Cilium DNS rule is narrowed to a few names. Which Helm value makes the DNS proxy reject queries in a way their resolver handles?

Cilium, Medium (Advanced), Troubleshooting. https://k8wiz.com/uquiz/alpine-based-pods-fail-dns-lookups-after-a-cilium-dns-rule-is-narrowed-to-a-few-names-which-helm-value-makes-the-dns-proxy-rejec

- A. dnsProxy.enableDnsCompression=false
- B. dnsProxy.dnsRejectResponseCode=nameError
- C. dnsProxy.minTtl=3600
- D. dnsProxy.proxyResponseMaxDelay=0s

**Answer:** dnsProxy.dnsRejectResponseCode=nameError

**Explanation:** By default the proxy answers a disallowed query with REFUSED. Some resolvers, such as musl in Alpine, treat that as a hard failure and stop walking the search list, so the real name is never tried. Answering with NXDOMAIN (nameError) lets them move on; lowering ndots in the pod's dnsConfig also works.