per-service DNS