DNS Filter (proto)

This extension has the qualified name envoy.filters.udp.dns_filter


This extension is functional but has not had substantial production burn time, use only with this caveat.

This extension is intended to be robust against untrusted downstream traffic. It assumes that the upstream is trusted.


This extension extends and can be used with the following extension category:

This extension must be configured with one of the following type URLs:

DNS Filter configuration overview.


[extensions.filters.udp.dns_filter.v3.DnsFilterConfig proto]

Configuration for the DNS filter.

  "stat_prefix": ...,
  "server_config": {...},
  "client_config": {...}

(string, REQUIRED) The stat prefix used when emitting DNS filter statistics


(extensions.filters.udp.dns_filter.v3.DnsFilterConfig.ServerContextConfig) Server context configuration contains the data that the filter uses to respond to DNS requests.


(extensions.filters.udp.dns_filter.v3.DnsFilterConfig.ClientContextConfig) Client context configuration controls Envoy’s behavior when it must use external resolvers to answer a query. This object is optional and if omitted instructs the filter to resolve queries from the data in the server_config


[extensions.filters.udp.dns_filter.v3.DnsFilterConfig.ServerContextConfig proto]

This message contains the configuration for the DNS Filter operating in a server context. This message will contain the virtual hosts and associated addresses with which Envoy will respond to queries

  "inline_dns_table": {...},
  "external_dns_table": {...}

(data.dns.v3.DnsTable) Load the configuration specified from the control plane

Precisely one of inline_dns_table, external_dns_table must be set.


(config.core.v3.DataSource) Seed the filter configuration from an external path. This source is a yaml formatted file that contains the DnsTable driving Envoy’s responses to DNS queries

Precisely one of inline_dns_table, external_dns_table must be set.


[extensions.filters.udp.dns_filter.v3.DnsFilterConfig.ClientContextConfig proto]

This message contains the configuration for the DNS Filter operating in a client context. This message will contain the timeouts, retry, and forwarding configuration for Envoy to make DNS requests to other resolvers

  "resolver_timeout": {...},
  "dns_resolution_config": {...},
  "typed_dns_resolver_config": {...},
  "max_pending_lookups": ...

(Duration) Sets the maximum time we will wait for the upstream query to complete We allow 5s for the upstream resolution to complete, so the minimum value here is 1. Note that the total latency for a failed query is the number of retries multiplied by the resolver_timeout.


(config.core.v3.DnsResolutionConfig) DNS resolution configuration which includes the underlying dns resolver addresses and options. This field is deprecated in favor of typed_dns_resolver_config.


(config.core.v3.TypedExtensionConfig) DNS resolver type configuration extension. This extension can be used to configure c-ares, apple, or any other DNS resolver types and the related parameters. For example, an object of CaresDnsResolverConfig can be packed into this typed_dns_resolver_config. This configuration replaces the dns_resolution_config configuration. During the transition period when both dns_resolution_config and typed_dns_resolver_config exists, when typed_dns_resolver_config is in place, Envoy will use it and ignore dns_resolution_config. When typed_dns_resolver_config is missing, the default behavior is in place.


This extension category has the following known extensions:


(uint64) Controls how many outstanding external lookup contexts the filter tracks. The context structure allows the filter to respond to every query even if the external resolution times out or is otherwise unsuccessful