# connection refused: dial tcp 10.96.0.10:53: connect: connection refused (due to NetworkPolicy)

- **ID:** `kubernetes/networkpolicy-blocking-dns`
- **Domain:** kubernetes
- **Category:** network_error
- **Verification:** ai_generated
- **Fix Rate:** 88%

## Root Cause

A NetworkPolicy is blocking DNS traffic (port 53) from the pod to the CoreDNS service, either by ingress or egress rules, preventing DNS resolution.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| Calico v3.27.2 | active | — | — |
| Cilium v1.15.0 | active | — | — |
| Kubernetes v1.28.5 | active | — | — |
| Kubernetes v1.29.1 | active | — | — |

## Workarounds

1. **Add an egress rule to allow DNS traffic in the pod's namespace: `kubectl edit networkpolicy <policy-name>` and add under egress: `- ports: [{port: 53, protocol: UDP}, {port: 53, protocol: TCP}]` and ensure the destination includes the kube-system namespace or the CoreDNS pod selector.** (90% success)
   ```
   Add an egress rule to allow DNS traffic in the pod's namespace: `kubectl edit networkpolicy <policy-name>` and add under egress: `- ports: [{port: 53, protocol: UDP}, {port: 53, protocol: TCP}]` and ensure the destination includes the kube-system namespace or the CoreDNS pod selector.
   ```
2. **Test connectivity to CoreDNS: `kubectl run -it --rm debug --image=busybox -- sh` then run `nslookup kubernetes.default.svc.cluster.local`. If it fails, inspect NetworkPolicies in the namespace: `kubectl describe networkpolicy -n <namespace>`** (85% success)
   ```
   Test connectivity to CoreDNS: `kubectl run -it --rm debug --image=busybox -- sh` then run `nslookup kubernetes.default.svc.cluster.local`. If it fails, inspect NetworkPolicies in the namespace: `kubectl describe networkpolicy -n <namespace>`
   ```

## Dead Ends

- **Restart the pod or delete and recreate it** — The NetworkPolicy is still in place, so restarting the pod will result in the same DNS failure. The policy must be modified. (95% fail)
- **Disable all NetworkPolicies by deleting them** — This is a security risk and defeats the purpose of network segmentation. A targeted fix is better, e.g., adding a policy that allows DNS. (60% fail)