Protect identity infrastructure in cloud-native environments

Cloud-native environments fundamentally change DNS traffic patterns, turning steady VM-era request streams into massive parallel bursts that overwhelm default identity infrastructure settings. When BIND's recursive-clients limit (default 900) is exceeded during pod restart storms, it silently drops queries while showing low CPU usage, creating phantom timeouts that are nearly impossible to diagnose. A defense-in-depth strategy addresses this with two changes: raising the recursive-clients limit to match actual cluster density (10,000 clients uses only ~50MB extra RAM on a 6GB host), and enabling CoreDNS caching via positiveTTL and negativeTTL parameters in the OpenShift DNS Operator (both default to 0). The negativeTTL setting is especially impactful because DNS search-domain expansion silently multiplies NXDOMAIN queries — 100 pods resolving one short name can generate 1,500 upstream hits, reduced to 15 with a 10-second negativeTTL. Industry-specific starting values are provided for financial services, healthcare, telecom, retail, government, manufacturing, and energy sectors. Combined tuning of all three parameters can reduce upstream IdM load by over 90% and eliminate the documented 907-timeout failure mode.