# An egress CiliumNetworkPolicy allows toFQDNs with matchName: api.example.com, but connections to that host are still dropped. The policy has no other rules. What is missing?

Cilium, Hard (Expert), Troubleshooting. https://k8wiz.com/uquiz/an-egress-ciliumnetworkpolicy-allows-tofqdns-with-matchname-apiexamplecom-but-connections-to-that-host-are-still-dropped-the-pol

- A. An egress rule allowing DNS to kube-dns with an L7 dns rule
- B. A ServiceEntry that registers api.example.com with the mesh
- C. Hubble Relay, which resolves FQDNs for the policy engine
- D. A trailing dot after the domain name in matchName

**Answer:** An egress rule allowing DNS to kube-dns with an L7 dns rule

**Explanation:** toFQDNs works by watching DNS answers. Cilium's DNS proxy reads the responses and adds the returned IPs to the policy. That only happens if the pod's DNS traffic to kube-dns is allowed and sent through the proxy with a rule such as 'rules: dns: - matchPattern: "*"'. Without it the policy never learns the IPs, and because the policy makes egress default-deny, the DNS queries themselves are blocked too.