Feature request: Ability for split DNS w/o DoT nor DoH

[samip5]

What's the feature 🧐

I want to be able to say that this specific domain needs to be resolved from Kubernetes DNS server and also set the routing so it can be reached.

Eg. coredns on 10.41.0.10 (default in Kubernetes that it's the .10 address).

Extra information and references

No response

[qdm12]

That should be done with the new DNS server, see #137 let's keep this opened though

[bjeanes]

Another use case for my current situation...

I am binding a few LinuxServer.io services to a gluetun instance and using https://github.com/tailscale-dev/docker-mod to embed a Tailscale user-level connection and proxy the service's web UI with tailscale serve.

I can get routing to/from the Tailscale to work fine, including local traversal, by properly setting FIREWALL_OUTBOUND_SUBNETS. However, DNS resolution for other Tailscale hosts (which is desirable in my arrangement) doesn't work because 127.0.0.1:53 just forwards this upstream (i.e. Cloudflare, by default).

It would ideal to be able to influence the unbound config to do something like this:

        private-domain: "ts.net."

forward-zone:
        name: "ts.net."
        forward-addr: 100.100.100.100

I recognise you've got goals to radically change how DNS works in gluetun, but it has been several years on that front. Is there something we could do in the interim, such as an env var like:

DNS_SPLIT_UPSTREAMS=some-root.domain.net/1.2.3.4,ts.net/100.100.100.100

?

[mstaffa]

Would like to bump this.

In Kubernetes in particular it would be helpful to be able to specify the cluster DNS resolver for instances where I want a container with gluetun to be able to resolve other services in the cluster.

I want a container in pod X to be able to connect to the service of pod Y by the service's name, not it's IP address.

@qdm12 if this is accomplished in #137 and PR #1742 could you suggest how to use it? Would be happy to create a PR updating the documentation if so.

[qdm12]

See #2970

[qdm12]

#2970 got merged in the latest image, so local names should resolve fine now (but leave DOT / DNS_SERVER on or it won't work). So the original issue is likely resolved now.

@bjeanes would you still need this configuration option to split DNS, if the built-in DNS recognizes local names and uses the local nameservers (like coredns) to resolve them?

[bjeanes]

I'm not sure without trying in the case of Tailscale nodes because TS brings its own resolver and I'm not sure off hand if it configures the local resolver in a way that would interact positively with this change, though it may well do so!

[ben-freke]

How does it determine what a "local domain" is?

Have looked at the PR but can't see any obvious configuration options for defining local domains.

I tried deploying #2970 but it was failing to resolve Kubernetes service domains. Might be a misconfiguration on my end.

The other problem was that, in my instance the Kube resolver is also recursive so it will resolve google.com if asked. Looking through the implementation it looks like it's relying on the assumption that the local resolver won't resolve public domains?

[ben-freke]

Just augmenting my previous comment on this - an example. In a pod with a gluetun sidecar, Gluetun is overwriting the etc/resolv.conf - fine. I assumed it was using search domains to determine local domains, but it's not.

root@pod-67d79b595d-w4rpx:/# cat etc/resolv.conf 
nameserver 1.1.1.1
search test.svc.cluster.local svc.cluster.local cluster.local
options ndots:5

root@pod-67d79b595d-w4rpx:/# nslookup google.com
Server:		1.1.1.1
Address:	1.1.1.1:53

Non-authoritative answer:
Name:	google.com
Address: 2a00:1450:400e:80f::200e

Non-authoritative answer:
Name:	google.com
Address: 172.217.23.206

root@pod-67d79b595d-w4rpx:/# nslookup kubernetes.default.svc.cluster.local
Server:		1.1.1.1
Address:	1.1.1.1:53

** server can't find tubernetes.default.svc.cluster.local: NXDOMAIN

** server can't find ubernetes.default.svc.cluster.local: NXDOMAIN

root@pod-67d79b595d-w4rpx:/# curl -k https://kubernetes.default.svc.cluster.local
curl: (6) Could not resolve host: kubernetes.default.svc.cluster.local

For context without gluetun

root@pod-5bb7c745b5-6b8d6:/# cat etc/resolv.conf 
search test.svc.cluster.local svc.cluster.local cluster.local
nameserver 10.43.0.10
options ndots:5

root@pod-5bb7c745b5-6b8d6:/# nslookup google.com
Server:		10.43.0.10
Address:	10.43.0.10:53

Non-authoritative answer:
Name:	google.com
Address: 142.250.129.113
[trunc]

root@pod-5bb7c745b5-6b8d6:/# nslookup kubernetes.default.svc.cluster.local
Server:		10.43.0.10
Address:	10.43.0.10:53

Name:	kubernetes.default.svc.cluster.local
Address: 10.43.0.1

And also the config

2025-11-20T08:09:33Z INFO Settings summary:                                                                                                                                                                                                   │
│ ├── VPN settings:                                                                                                                                                                                                                             │
│ |   ├── VPN provider settings:                                                                                                                                                                                                                │
│ |   |   ├── Name: custom                                                                                                                                                                                                                      │
│ |   |   └── Server selection settings:                                                                                                                                                                                                        │
│ |   |       ├── VPN type: wireguard                                                                                                                                                                                                           │
│ |   |       └── Wireguard selection settings:                                                                                                                                                                                                 │
│ |   |           ├── Endpoint IP address: [REMOVED]                                                                                                                                                                                 │
│ |   |           ├── Endpoint port: 51820                                                                                                                                                                                                      │
│ |   |           └── Server public key: [REMOVED] =                                                                                                                                                       │
│ |   └── Wireguard settings:                                                                                                                                                                                                                   │
│ |       ├── Private key: [REMOVED]                                                                                                                                                                                                           │
│ |       ├── Interface addresses:                                                                                                                                                                                                              │
│ |       |   └── 10.2.0.2/32                                                                                                                                                                                                                   │
│ |       ├── Allowed IPs:                                                                                                                                                                                                                      │
│ |       |   ├── 0.0.0.0/0                                                                                                                                                                                                                     │
│ |       |   └── ::/0                                                                                                                                                                                                                          │
│ |       └── Network interface: tun0                                                                                                                                                                                                           │
│ |           └── MTU: 1320                                                                                                                                                                                                                     │
│ ├── DNS settings:                                                                                                                                                                                                                             │
│ |   ├── Upstream resolver type: dot                                                                                                                                                                                                           │
│ |   ├── Upstream resolvers:                                                                                                                                                                                                                   │
│ |   |   └── cloudflare                                                                                                                                                                                                                        │
│ |   ├── Caching: yes                                                                                                                                                                                                                          │
│ |   ├── IPv6: no                                                                                                                                                                                                                              │
│ |   ├── Update period: every 24h0m0s                                                                                                                                                                                                          │
│ |   └── DNS filtering settings:                                                                                                                                                                                                               │
│ |       ├── Block malicious: yes                                                                                                                                                                                                              │
│ |       ├── Block ads: no                                                                                                                                                                                                                     │
│ |       └── Block surveillance: no                                                                                                                                                                                                            │
│ ├── Firewall settings:                                                                                                                                                                                                                        │
│ |   ├── Enabled: yes                                                                                                                                                                                                                          │
│ |   ├── Input ports:                                                                                                                                                                                                                          │
│ |   |   ├── 4143                                                                                                                                                                                                                              │
│ |   |   └── 4191                                                                                                                                                                                                                              │
│ |   └── Outbound subnets:                                                                                                                                                                                                                     │
│ |       ├── 10.42.0.0/16                                                                                                                                                                                                                      │
│ |       ├── 10.43.0.0/16                                                                                                                                                                                                                      │
│ |       └── 10.0.0.0/8                                                                                                                                                                                                                        │
│ ├── Log settings:                                                                                                                                                                                                                             │
│ |   └── Log level: info                                                                                                                                                                                                                       │
│ ├── Health settings:                                                                                                                                                                                                                          │
│ |   ├── Server listening address: 127.0.0.1:9999                                                                                                                                                                                              │
│ |   ├── Target address: cloudflare.com:443                                                                                                                                                                                                    │
│ |   ├── ICMP target IP: 1.1.1.1                                                                                                                                                                                                               │
│ |   └── Restart VPN on healthcheck failure: yes                                                                                                                                                                                               │
│ ├── Shadowsocks server settings:                                                                                                                                                                                                              │
│ |   └── Enabled: no                                                                                                                                                                                                                           │
│ ├── HTTP proxy settings:                                                                                                                                                                                                                      │
│ |   └── Enabled: no                                                                                                                                                                                                                           │
│ ├── Control server settings:    
│ |   ├── Listening address: :8000                                                                                                                                                                                                              │
│ |   ├── Logging: yes                                                                                                                                                                                                                          │
│ |   └── Authentication file path: /gluetun/auth/config.toml                                                                                                                                                                                   │
│ ├── Storage settings:                                                                                                                                                                                                                         │
│ |   └── Filepath: /gluetun/servers.json                                                                                                                                                                                                       │
│ ├── OS Alpine settings:                                                                                                                                                                                                                       │
│ |   ├── Process UID: 0                                                                                                                                                                                                                        │
│ |   └── Process GID: 0                                                                                                                                                                                                                        │
│ ├── Public IP settings:                                                                                                                                                                                                                       │
│ |   ├── IP file path: /tmp/gluetun/ip                                                                                                                                                                                                         │
│ |   ├── Public IP data base API: ipinfo                                                                                                                                                                                                       │
│ |   └── Public IP data backup APIs:                                                                                                                                                                                                           │
│ |       ├── ifconfigco                                                                                                                                                                                                                        │
│ |       ├── ip2location                                                                                                                                                                                                                       │
│ |       └── cloudflare                                                                                                                                                                                                                        │
│ └── Version settings:                                                                                                                                                                                                                         │
│     └── Enabled: yes