Alpine-based pods fail DNS lookups after a Cilium DNS rule is narrowed to a few names. Which Helm value makes the DNS proxy reject queries in a way their resolver handles?

Answer: dnsProxy.dnsRejectResponseCode=nameError

Explanation

By default the proxy answers a disallowed query with REFUSED. Some resolvers, such as musl in Alpine, treat that as a hard failure and stop walking the search list, so the real name is never tried. Answering with NXDOMAIN (nameError) lets them move on; lowering ndots in the pod's dnsConfig also works.