# DNS Spoofing Attacks inside a Cluster

**URL:** <https://discuss.kubernetes.io/t/dns-spoofing-attacks-inside-a-cluster/11455>\
**Category:** General Discussions\
**Tags:** security\
**Created:** [June 16, 2020, 2:15pm UTC](https://discuss.kubernetes.io/t/dns-spoofing-attacks-inside-a-cluster/11455 "2020-06-16T14:15:37Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![netwalker](https://avatars.discourse-cdn.com/v4/letter/n/bbce88/32.png) [@netwalker](https://discuss.kubernetes.io/u/netwalker)\
**Post date:** [June 16, 2020, 2:15pm UTC](https://discuss.kubernetes.io/t/dns-spoofing-attacks-inside-a-cluster/11455/1 "2020-06-16T14:15:38Z")

</div>

How can I protect myself against DNS spoofing attacks in a Kubernetes cluster?  
For example. A customer creates a project on a node with a namespace called “com” and a service called “google”

As far as I have tested this, every DNS request within the cluster to [google.com](http://google.com) should go to the namespace mentioned above. That would be fatal.  
Is there a central place where I can specify that the internal DNS (CoreDNS) is only used for internal DNS queries? The external DNS lookups should always be forwarded to the upstream DNS server.

Is there a policy or a config for this that can be used to get the problem under control?

---

<div class="post-metadata">

**Author:** ![thockin](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/thockin/32/2457_2.png) [@thockin](https://discuss.kubernetes.io/u/thockin)\
**Post date:** [June 16, 2020, 3:48pm UTC](https://discuss.kubernetes.io/t/dns-spoofing-attacks-inside-a-cluster/11455/2 "2020-06-16T15:48:51Z")

</div>

This is an unfortunate side-effect of aggressive use of search paths. There are 3 main options I see

1. Don’t create a “com” namespace or allow your users to do so.
2. Disable search paths via DNSPolicy = “None” + DNSConfig
3. Always use fully qualified names, including a trailing period, which pypasses any search expansion