DNS Filter

This extension may be referenced by the qualified name envoy.filters.udp_listener.dns_filter


This extension is functional but has not had substantial production burn time, use only with this caveat.

This extension is intended to be robust against untrusted downstream traffic. It assumes that the upstream is trusted.


This extension extends and can be used with the following extension category:


This API is work-in-progress and is subject to breaking changes.

DNS Filter configuration overview.


[extensions.filters.udp.dns_filter.v3alpha.DnsFilterConfig proto]

Configuration for the DNS filter.

  "stat_prefix": "...",
  "server_config": "{...}",
  "client_config": "{...}"

(string, REQUIRED) The stat prefix used when emitting DNS filter statistics


(extensions.filters.udp.dns_filter.v3alpha.DnsFilterConfig.ServerContextConfig) Server context configuration contains the data that the filter uses to respond to DNS requests.


(extensions.filters.udp.dns_filter.v3alpha.DnsFilterConfig.ClientContextConfig) Client context configuration controls Envoy’s behavior when it must use external resolvers to answer a query. This object is optional and if omitted instructs the filter to resolve queries from the data in the server_config


[extensions.filters.udp.dns_filter.v3alpha.DnsFilterConfig.ServerContextConfig proto]

This message contains the configuration for the DNS Filter operating in a server context. This message will contain the virtual hosts and associated addresses with which Envoy will respond to queries

  "inline_dns_table": "{...}",
  "external_dns_table": "{...}"

(data.dns.v3.DnsTable) Load the configuration specified from the control plane

Precisely one of inline_dns_table, external_dns_table must be set.


(config.core.v3.DataSource) Seed the filter configuration from an external path. This source is a yaml formatted file that contains the DnsTable driving Envoy’s responses to DNS queries

Precisely one of inline_dns_table, external_dns_table must be set.


[extensions.filters.udp.dns_filter.v3alpha.DnsFilterConfig.ClientContextConfig proto]

This message contains the configuration for the DNS Filter operating in a client context. This message will contain the timeouts, retry, and forwarding configuration for Envoy to make DNS requests to other resolvers

  "resolver_timeout": "{...}",
  "upstream_resolvers": [],
  "max_pending_lookups": "..."

(Duration) Sets the maximum time we will wait for the upstream query to complete We allow 5s for the upstream resolution to complete, so the minimum value here is 1. Note that the total latency for a failed query is the number of retries multiplied by the resolver_timeout.


(repeated config.core.v3.Address) A list of DNS servers to which we can forward queries. If not specified, Envoy will use the ambient DNS resolvers in the system.


(uint64) Controls how many outstanding external lookup contexts the filter tracks. The context structure allows the filter to respond to every query even if the external resolution times out or is otherwise unsuccessful