Kubernetes ndots:5 Search Domain NxDomain Flood

Problem

Kubernetes pods have ndots:5 and a custom search domain (e.g., viktorbarzin.lan) in their /etc/resolv.conf. When resolving internal service names like redis.redis.svc.cluster.local (4 dots < ndots:5), glibc tries all search domain suffixes before the absolute name. This generates queries like:

1. redis.redis.svc.cluster.local.namespace.svc.cluster.local (CoreDNS handles, NxDomain)
2. redis.redis.svc.cluster.local.svc.cluster.local (CoreDNS handles, NxDomain)
3. redis.redis.svc.cluster.local.cluster.local (CoreDNS handles, NxDomain)
4. redis.redis.svc.cluster.local.yourdomain.lan (CoreDNS forwards to external DNS, NxDomain)
5. redis.redis.svc.cluster.local (finally resolves)

Step 4 is the problem: CoreDNS forwards *.yourdomain.lan queries to the external DNS server, flooding it with junk NxDomain requests. With hundreds of pods making DNS lookups, this generates tens of thousands of useless queries per day.