unconfined: dns is optional