Repository: envoyproxy/gateway
Pull request #5324 (2025-02-21 20:23:50)

feat: adding support for DNSLookupFamily api
Makes it possible to define DNS lookup family for xRoute and non-xRoute BackendRefs.

**What this PR does / why we need it**:
Implements:
https://github.com/envoyproxy/gateway/pull/5249

**Which issue(s) this PR fixes**:
https://github.com/envoyproxy/gateway/issues/5247

codecov[bot]: ## [Codecov](https://app.codecov.io/gh/envoyproxy/gateway/pull/5324?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy) Report
Attention: Patch coverage is `68.75000%` with `5 lines` in your changes missing coverage. Please review.
> Project coverage is 64.96%. Comparing base [(`57c7e64`)](https://app.codecov.io/gh/envoyproxy/gateway/commit/57c7e645188d8ff1b4fd6c9c52a3aad0eabcc76f?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy) to head [(`1d39eb8`)](https://app.codecov.io/gh/envoyproxy/gateway/commit/1d39eb831163d03ea0624215cd0409b35e8c7e7c?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy).

| [Files with missing lines](https://app.codecov.io/gh/envoyproxy/gateway/pull/5324?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy) | Patch % | Lines |
|---|---|---|
| [internal/xds/translator/cluster.go](https://app.codecov.io/gh/envoyproxy/gateway/pull/5324?src=pr&el=tree&filepath=internal%2Fxds%2Ftranslator%2Fcluster.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy#diff-aW50ZXJuYWwveGRzL3RyYW5zbGF0b3IvY2x1c3Rlci5nbw==) | 66.66% | [5 Missing :warning: ](https://app.codecov.io/gh/envoyproxy/gateway/pull/5324?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy) |

<details><summary>Additional details and impacted files</summary>


```diff
@@            Coverage Diff             @@
##             main    #5324      +/-   ##
==========================================
+ Coverage   64.90%   64.96%   +0.06%     
==========================================
  Files         213      213              
  Lines       33454    33469      +15     
==========================================
+ Hits        21712    21742      +30     
+ Misses      10409    10398      -11     
+ Partials     1333     1329       -4     
```

</details>

[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/envoyproxy/gateway/pull/5324?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy).   
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=envoyproxy).

alexwo: > Nit: I assume that the DNSLookupFamily settings is only relevant to the Backend FQDN type endpoints? If so, should we mention this in the API? Otherwise, it could confuse users.

Right, Destination setting created for Service resources have their IPFamily determined by: 

https://github.com/envoyproxy/gateway/blob/a58021e6b4ae79fc268249cffcab8e342b04171b/internal/gatewayapi/route.go#L1358

So right now it will apply for backends. 
zhaohuabing: > So right now it will apply for backends dns resolution.

Could you please add comment to the BackendTrafficPolicy API clarifying that the DNS Lookup Family setting only affects targeted Routes with an FQDN backend?  The current API doc is somewhat vague, and this clarification would help improve understanding.

```
	// LookupFamily determines how Envoy would resolve DNS for. If set, this configuration overrides other default
	// value that Envoy Gateway configures based on attributes of the backends, such Service resource IPFamilies.
	// +optional
	// +notImplementedHide
	LookupFamily *DNSLookupFamily `json:"lookupFamily,omitempty"`
```

Patch:
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 8e8d33c94..c36c9f62a 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -20,6 +20,9 @@ updates:
     ignore:
       # skip to update retest, because it won't work with the latest version
       - dependency-name: "envoyproxy/toolshed/gh-actions/retest"
+    groups:
+      github-actions:
+        - "actions*"
   - package-ecosystem: gomod
     directories:
       - "/"
@@ -27,18 +30,20 @@ updates:
     schedule:
       interval: weekly
     groups:
+      github.com:
+        patterns:
+          - "github.com*"
       k8s.io:
         patterns:
           - "k8s.io/*"
           - "sigs.k8s.io/*"
       go.opentelemetry.io:
         patterns:
-          - "go.opentelemetry.io/*"
+          - "go.opentelemetry.io*"
       golang.org:
         patterns:
-          - "golang.org/*"
-          - "google.golang.org/*"
-          - "google.golang.org/genproto/googleapis/*"
+          - "golang*"
+          - "google*"
   - package-ecosystem: pip
     directories:
       - /tools/src/codespell
@@ -46,12 +51,3 @@ updates:
       - /tools/src/yamllint
     schedule:
       interval: weekly
-  - package-ecosystem: gomod
-    directories:
-      - /tools/src/helm-docs
-      - /tools/src/buf
-      - /tools/src/golangci-lint
-      - /tools/src/kind
-      - /tools/src/setup-envtest
-    schedule:
-      interval: weekly
diff --git a/api/v1alpha1/dns_types.go b/api/v1alpha1/dns_types.go
index 53005fa57..ed99a6ca0 100644
--- a/api/v1alpha1/dns_types.go
+++ b/api/v1alpha1/dns_types.go
@@ -36,9 +36,8 @@ type DNS struct {
 	// If the value is set to true, the DNS refresh rate will be set to the resource record’s TTL.
 	// Defaults to true.
 	RespectDNSTTL *bool `json:"respectDnsTtl,omitempty"`
-	// LookupFamily determines how Envoy would resolve DNS for. If set, this configuration overrides other default
-	// value that Envoy Gateway configures based on attributes of the backends, such Service resource IPFamilies.
+	// LookupFamily determines how Envoy would resolve DNS for Routes where the backend is specified as a fully qualified domain name (FQDN).
+	// If set, this configuration overrides other defaults.
 	// +optional
-	// +notImplementedHide
 	LookupFamily *DNSLookupFamily `json:"lookupFamily,omitempty"`
 }
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml
index 1471f7fa3..c135bead9 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml
@@ -165,8 +165,8 @@ spec:
                     type: string
                   lookupFamily:
                     description: |-
-                      LookupFamily determines how Envoy would resolve DNS for. If set, this configuration overrides other default
-                      value that Envoy Gateway configures based on attributes of the backends, such Service resource IPFamilies.
+                      LookupFamily determines how Envoy would resolve DNS for Routes where the backend is specified as a fully qualified domain name (FQDN).
+                      If set, this configuration overrides other defaults.
                     enum:
                     - IPv4
                     - IPv6
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
index 096046db9..f1ea85024 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
@@ -311,8 +311,8 @@ spec:
                               type: string
                             lookupFamily:
                               description: |-
-                                LookupFamily determines how Envoy would resolve DNS for. If set, this configuration overrides other default
-                                value that Envoy Gateway configures based on attributes of the backends, such Service resource IPFamilies.
+                                LookupFamily determines how Envoy would resolve DNS for Routes where the backend is specified as a fully qualified domain name (FQDN).
+                                If set, this configuration overrides other defaults.
                               enum:
                               - IPv4
                               - IPv6
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
index f96e95c69..b0c4d78f1 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
@@ -10769,8 +10769,8 @@ spec:
                                                 type: string
                                               lookupFamily:
                                                 description: |-
-                                                  LookupFamily determines how Envoy would resolve DNS for. If set, this configuration overrides other default
-                                                  value that Envoy Gateway configures based on attributes of the backends, such Service resource IPFamilies.
+                                                  LookupFamily determines how Envoy would resolve DNS for Routes where the backend is specified as a fully qualified domain name (FQDN).
+                                                  If set, this configuration overrides other defaults.
                                                 enum:
                                                 - IPv4
                                                 - IPv6
@@ -11767,8 +11767,8 @@ spec:
                                                 type: string
                                               lookupFamily:
                                                 description: |-
-                                                  LookupFamily determines how Envoy would resolve DNS for. If set, this configuration overrides other default
-                                                  value that Envoy Gateway configures based on attributes of the backends, such Service resource IPFamilies.
+                                                  LookupFamily determines how Envoy would resolve DNS for Routes where the backend is specified as a fully qualified domain name (FQDN).
+                                                  If set, this configuration overrides other defaults.
                                                 enum:
                                                 - IPv4
                                                 - IPv6
@@ -12858,8 +12858,8 @@ spec:
                                           type: string
                                         lookupFamily:
                                           description: |-
-                                            LookupFamily determines how Envoy would resolve DNS for. If set, this configuration overrides other default
-                                            value that Envoy Gateway configures based on attributes of the backends, such Service resource IPFamilies.
+                                            LookupFamily determines how Envoy would resolve DNS for Routes where the backend is specified as a fully qualified domain name (FQDN).
+                                            If set, this configuration overrides other defaults.
                                           enum:
                                           - IPv4
                                           - IPv6
@@ -13864,8 +13864,8 @@ spec:
                                     type: string
                                   lookupFamily:
                                     description: |-
-                                      LookupFamily determines how Envoy would resolve DNS for. If set, this configuration overrides other default
-                                      value that Envoy Gateway configures based on attributes of the backends, such Service resource IPFamilies.
+                                      LookupFamily determines how Envoy would resolve DNS for Routes where the backend is specified as a fully qualified domain name (FQDN).
+                                      If set, this configuration overrides other defaults.
                                     enum:
                                     - IPv4
                                     - IPv6
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
index 3abb3d79e..a48bc49ec 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
@@ -796,8 +796,8 @@ spec:
                                 type: string
                               lookupFamily:
                                 description: |-
-                                  LookupFamily determines how Envoy would resolve DNS for. If set, this configuration overrides other default
-                                  value that Envoy Gateway configures based on attributes of the backends, such Service resource IPFamilies.
+                                  LookupFamily determines how Envoy would resolve DNS for Routes where the backend is specified as a fully qualified domain name (FQDN).
+                                  If set, this configuration overrides other defaults.
                                 enum:
                                 - IPv4
                                 - IPv6
@@ -1698,8 +1698,8 @@ spec:
                                 type: string
                               lookupFamily:
                                 description: |-
-                                  LookupFamily determines how Envoy would resolve DNS for. If set, this configuration overrides other default
-                                  value that Envoy Gateway configures based on attributes of the backends, such Service resource IPFamilies.
+                                  LookupFamily determines how Envoy would resolve DNS for Routes where the backend is specified as a fully qualified domain name (FQDN).
+                                  If set, this configuration overrides other defaults.
                                 enum:
                                 - IPv4
                                 - IPv6
@@ -2729,8 +2729,8 @@ spec:
                                       type: string
                                     lookupFamily:
                                       description: |-
-                                        LookupFamily determines how Envoy would resolve DNS for. If set, this configuration overrides other default
-                                        value that Envoy Gateway configures based on attributes of the backends, such Service resource IPFamilies.
+                                        LookupFamily determines how Envoy would resolve DNS for Routes where the backend is specified as a fully qualified domain name (FQDN).
+                                        If set, this configuration overrides other defaults.
                                       enum:
                                       - IPv4
                                       - IPv6
@@ -3771,8 +3771,8 @@ spec:
                                 type: string
                               lookupFamily:
                                 description: |-
-                                  LookupFamily determines how Envoy would resolve DNS for. If set, this configuration overrides other default
-                                  value that Envoy Gateway configures based on attributes of the backends, such Service resource IPFamilies.
+                                  LookupFamily determines how Envoy would resolve DNS for Routes where the backend is specified as a fully qualified domain name (FQDN).
+                                  If set, this configuration overrides other defaults.
                                 enum:
                                 - IPv4
                                 - IPv6
diff --git a/go.mod b/go.mod
index e1023c7bf..53818831a 100644
--- a/go.mod
+++ b/go.mod
@@ -461,11 +461,11 @@ require (
 	go.uber.org/mock v0.5.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap/exp v0.3.0 // indirect
-	golang.org/x/crypto v0.33.0 // indirect
+	golang.org/x/crypto v0.35.0 // indirect
 	golang.org/x/crypto/x509roots/fallback v0.0.0-20240904212608-c9da6b9a4008 // indirect
 	golang.org/x/exp/typeparams v0.0.0-20250210185358-939b2ce775ac // indirect
 	golang.org/x/mod v0.23.0 // indirect
-	golang.org/x/oauth2 v0.25.0 // indirect
+	golang.org/x/oauth2 v0.27.0 // indirect
 	golang.org/x/sync v0.11.0 // indirect
 	golang.org/x/sys v0.30.0 // indirect
 	golang.org/x/term v0.29.0 // indirect
diff --git a/go.sum b/go.sum
index 34ddc9f45..315793206 100644
--- a/go.sum
+++ b/go.sum
@@ -1408,8 +1408,8 @@ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
-golang.org/x/crypto v0.33.0 h1:IOBPskki6Lysi0lo9qQvbxiQ+FvsCC/YWOecCHAixus=
-golang.org/x/crypto v0.33.0/go.mod h1:bVdXmD7IV/4GdElGPozy6U7lWdRXA4qyRVGJV57uQ5M=
+golang.org/x/crypto v0.35.0 h1:b15kiHdrGCHrP6LvwaQ3c03kgNhhiMgvlhxHQhmg2Xs=
+golang.org/x/crypto v0.35.0/go.mod h1:dy7dXNW32cAb/6/PRuTNsix8T+vJAqvuIy5Bli/x0YQ=
 golang.org/x/crypto/x509roots/fallback v0.0.0-20240904212608-c9da6b9a4008 h1:vKHSxFhPLnBEYu9R8DcQ4gXq9EqU0VVhC9pq9wmtYsg=
 golang.org/x/crypto/x509roots/fallback v0.0.0-20240904212608-c9da6b9a4008/go.mod h1:kNa9WdvYnzFwC79zRpLRMJbdEFlhyM5RPFBBZp/wWH8=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -1475,8 +1475,8 @@ golang.org/x/net v0.35.0/go.mod h1:EglIi67kWsHKlRzzVMUD93VMSWGFOMSZgxFjparz1Qk=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.25.0 h1:CY4y7XT9v0cRI9oupztF8AgiIu99L/ksR/Xp/6jrZ70=
-golang.org/x/oauth2 v0.25.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
+golang.org/x/oauth2 v0.27.0 h1:da9Vo7/tDv5RH/7nZDz1eMGS/q1Vv1N/7FCrBhI9I3M=
+golang.org/x/oauth2 v0.27.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
diff --git a/internal/gatewayapi/clustersettings.go b/internal/gatewayapi/clustersettings.go
index 1b77b8adb..cc54c3ae2 100644
--- a/internal/gatewayapi/clustersettings.go
+++ b/internal/gatewayapi/clustersettings.go
@@ -475,6 +475,7 @@ func translateDNS(policy egv1a1.ClusterSettings) *ir.DNS {
 		return nil
 	}
 	return &ir.DNS{
+		LookupFamily:   policy.DNS.LookupFamily,
 		RespectDNSTTL:  policy.DNS.RespectDNSTTL,
 		DNSRefreshRate: policy.DNS.DNSRefreshRate,
 	}
diff --git a/internal/ir/xds.go b/internal/ir/xds.go
index 52858264f..4383ffb5d 100644
--- a/internal/ir/xds.go
+++ b/internal/ir/xds.go
@@ -763,6 +763,8 @@ type DNS struct {
 	DNSRefreshRate *metav1.Duration `json:"dnsRefreshRate,omitempty"`
 	// RespectDNSTTL indicates whether the DNS Time-To-Live (TTL) should be respected.
 	RespectDNSTTL *bool `json:"respectDnsTtl,omitempty"`
+	// LookupFamily allows to configure the dns lookup policy
+	LookupFamily *egv1a1.DNSLookupFamily `json:"lookupFamily,omitempty"`
 }
 
 // SessionPersistence defines the desired state of SessionPersistence.
diff --git a/internal/ir/zz_generated.deepcopy.go b/internal/ir/zz_generated.deepcopy.go
index 674293684..98cf2a997 100644
--- a/internal/ir/zz_generated.deepcopy.go
+++ b/internal/ir/zz_generated.deepcopy.go
@@ -744,6 +744,11 @@ func (in *DNS) DeepCopyInto(out *DNS) {
 		*out = new(bool)
 		**out = **in
 	}
+	if in.LookupFamily != nil {
+		in, out := &in.LookupFamily, &out.LookupFamily
+		*out = new(v1alpha1.DNSLookupFamily)
+		**out = **in
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DNS.
diff --git a/internal/xds/translator/cluster.go b/internal/xds/translator/cluster.go
index 7d16afdf4..a380d7ecd 100644
--- a/internal/xds/translator/cluster.go
+++ b/internal/xds/translator/cluster.go
@@ -85,6 +85,22 @@ func buildEndpointType(settings []*ir.DestinationSetting) EndpointType {
 
 func buildXdsCluster(args *xdsClusterArgs) *clusterv3.Cluster {
 	dnsLookupFamily := clusterv3.Cluster_V4_PREFERRED
+	customDNSPolicy := args.dns != nil && args.dns.LookupFamily != nil
+	// apply DNS lookup family if custom DNS traffic policy is set
+	if customDNSPolicy {
+		switch *args.dns.LookupFamily {
+		case egv1a1.IPv4DNSLookupFamily:
+			dnsLookupFamily = clusterv3.Cluster_V4_ONLY
+		case egv1a1.IPv6DNSLookupFamily:
+			dnsLookupFamily = clusterv3.Cluster_V6_ONLY
+		case egv1a1.IPv6PreferredDNSLookupFamily:
+			dnsLookupFamily = clusterv3.Cluster_AUTO
+		case egv1a1.IPv4AndIPv6DNSLookupFamily:
+			dnsLookupFamily = clusterv3.Cluster_ALL
+		}
+	}
+
+	// Ensure to override if a specific IP family is set.
 	if args.ipFamily != nil {
 		switch *args.ipFamily {
 		case egv1a1.IPv4:
@@ -92,7 +108,10 @@ func buildXdsCluster(args *xdsClusterArgs) *clusterv3.Cluster {
 		case egv1a1.IPv6:
 			dnsLookupFamily = clusterv3.Cluster_V6_ONLY
 		case egv1a1.DualStack:
-			dnsLookupFamily = clusterv3.Cluster_ALL
+			// if a custom DNS policy is set, prefer the custom policy as its more specific.
+			if !customDNSPolicy {
+				dnsLookupFamily = clusterv3.Cluster_ALL
+			}
 		}
 	}
 
diff --git a/site/content/en/about/index.md b/site/content/en/about/index.md
index 102c0a7c2..6e25e4d6b 100644
--- a/site/content/en/about/index.md
+++ b/site/content/en/about/index.md
@@ -1,9 +1,7 @@
----
-title: About Envoy Gateway
-menu:
-  main:
-    weight: 10
----
++++
+title = "About Envoy Gateway"
+linktitle = "About"
++++
 
 {{% blocks/cover title="Advanced Traffic Management for Everyone" height="auto" color="primary" %}}
 <div class="container">
diff --git a/site/content/en/news/releases/_index.md b/site/content/en/news/releases/_index.md
index da1190cec..b17713168 100644
--- a/site/content/en/news/releases/_index.md
+++ b/site/content/en/news/releases/_index.md
@@ -47,14 +47,14 @@ In order to align with the Envoy Proxy [release schedule][], Envoy Gateway relea
 | Version |  Expected   |   Actual    | Difference  | End of Life |
 |:-------:|:-----------:|:-----------:|:-----------:|:-----------:|
 |  0.2.0  | 2022/10/22  | 2022/10/20  |   -2 days   |  2023/4/20  |
-|  0.3.0  | 2023/01/22  | 2023/02/09  |   +17 days  |  2023/08/09 |
-|  0.4.0  | 2023/04/22  | 2023/04/24  |   +2 days   |  2023/10/24 |
-|  0.5.0  | 2023/07/22  | 2023/08/02  |   +10 days  |  2024/01/02 |
-|  0.6.0  | 2023/10/22  | 2023/11/02  |   +10 days  |  2024/05/02 |
-|  1.0.x  | 2024/03/06  | 2023/03/13  |   +7 days   |  2024/09/13 |
-|  1.1.x  | 2024/07/16	| 2024/07/22  |   +6 days   |  2024/01/22 |
-|  1.2.x  | 2024/10/22	| 2024/11/06  |   +14 days  |  2025/05/06 |
-|  1.3.x  | 2025/01/30	| 2025/01/30  |             |  2025/07/30 |
+|  0.3.0  | 2023/01/22  | 2023/02/09  |   +17 days  | 2023/08/09  |
+|  0.4.0  | 2023/04/22  | 2023/04/24  |   +2 days   | 2023/10/24  |
+|  0.5.0  | 2023/07/22  | 2023/08/02  |   +10 days  | 2024/01/02  |
+|  0.6.0  | 2023/10/22  | 2023/11/02  |   +10 days  | 2024/05/02  |
+|  1.0.x  | 2024/03/06  | 2023/03/13  |   +7 days   | 2024/09/13  |
+|  1.1.x  | 2024/07/16	| 2024/07/22  |   +6 days   | 2025/01/22  |
+|  1.2.x  | 2024/10/22	| 2024/11/06  |   +14 days  | 2025/05/06  |
+|  1.3.x  | 2025/01/30	| 2025/01/30  |             | 2025/07/30  |
 
 [v2.0.0 spec]: https://semver.org/spec/v2.0.0.html
 [release guide]: ../../contributions/releasing
diff --git a/tools/make/golang.mk b/tools/make/golang.mk
index 95eec179b..9d7d568ff 100644
--- a/tools/make/golang.mk
+++ b/tools/make/golang.mk
@@ -80,8 +80,6 @@ go.clean: ## Clean the building output files
 go.mod.tidy: ## Update and check dependences with go mod tidy.
 	@$(LOG_TARGET)
 	go mod tidy -compat=$(GO_VERSION)
-	# run go mod tidy in examples/extension-server directory
-	cd examples/extension-server && go mod tidy -compat=$(GO_VERSION)
 
 .PHONY: go.mod.lint
 lint: go.mod.lint


Test patch:
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-dns-lookup-family.in.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-dns-lookup-family.in.yaml
new file mode 100644
index 000000000..9fcec7945
--- /dev/null
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-dns-lookup-family.in.yaml
@@ -0,0 +1,226 @@
+envoyProxyForGatewayClass:
+  apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: EnvoyProxy
+  metadata:
+    namespace: envoy-gateway
+    name: config-for-gateway-class
+  spec:
+    telemetry:
+      accessLog:
+        settings:
+          - format:
+              type: Text
+              text: |
+                [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
+            sinks:
+              - type: File
+                file:
+                  path: /dev/stdout
+              - type: OpenTelemetry
+                openTelemetry:
+                  backendSettings:
+                    dns:
+                      dnsRefreshRate: 30s
+                      lookupFamily: IPv4AndIPv6
+                  backendRefs:
+                    - name: logs
+                      namespace: default
+                      kind: Service
+                      port: 8080
+                  resources:
+                    k8s.cluster.name: "cluster-1"
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+grpcRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: GRPCRoute
+    metadata:
+      namespace: default
+      name: grpcroute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          sectionName: http
+      rules:
+        - backendRefs:
+            - name: backend-fqdn
+              port: 8080
+              kind: Backend
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      hostnames:
+        - gateway.envoyproxy.io
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: backend-fqdn
+              kind: Backend
+              port: 8080
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      name: logs
+      namespace: default
+    spec:
+      clusterIP: 10.11.12.13
+      ports:
+        - port: 8080
+          name: http1
+          protocol: TCP
+          targetPort: 8080
+backends:
+  - apiVersion: gateway.envoyproxy.io/v1alpha1
+    kind: Backend
+    metadata:
+      name: backend-fqdn2
+      namespace: default
+    spec:
+      endpoints:
+        - fqdn:
+            hostname: backend-v2.gateway-conformance-infra.svc.cluster.local
+            port: 9090
+  - apiVersion: gateway.envoyproxy.io/v1alpha1
+    kind: Backend
+    metadata:
+      name: backend-fqdn
+      namespace: default
+    spec:
+      endpoints:
+        - fqdn:
+            hostname: grpc-infra-backend.gateway-conformance-infra.svc.cluster.local
+            port: 8080
+  - apiVersion: gateway.envoyproxy.io/v1alpha1
+    kind: Backend
+    metadata:
+      name: backend-fqdn3
+      namespace: default
+    spec:
+      endpoints:
+        - fqdn:
+            hostname: backend-v3.gateway-conformance-infra.svc.cluster.local
+            port: 8080
+  - apiVersion: gateway.envoyproxy.io/v1alpha1
+    kind: Backend
+    metadata:
+      name: backend-fqdn
+      namespace: default
+    spec:
+      endpoints:
+        - fqdn:
+            hostname: grpc-infra-backend-v1.gateway-conformance-infra.svc.cluster.local
+            port: 8080
+backendTrafficPolicies:
+  - apiVersion: gateway.envoyproxy.io/v1alpha1
+    kind: BackendTrafficPolicy
+    metadata:
+      namespace: default
+      name: backend-traffic-policy
+    spec:
+      targetRef:
+        group: gateway.networking.k8s.io
+        kind: GRPCRoute
+        name: grpcroute-1
+      dns:
+        lookupFamily: IPv6
+        dnsRefreshRate: "5s"
+        respectDnsTtl: false
+  - apiVersion: gateway.envoyproxy.io/v1alpha1
+    kind: BackendTrafficPolicy
+    metadata:
+      namespace: default
+      name: backend-traffic-policy
+    spec:
+      targetRef:
+        group: gateway.networking.k8s.io
+        kind: HTTPRoute
+        name: httproute-1
+      dns:
+        lookupFamily: IPv4Only
+        dnsRefreshRate: "5s"
+        respectDnsTtl: false
+envoyExtensionPolicies:
+  - apiVersion: gateway.envoyproxy.io/v1alpha1
+    kind: EnvoyExtensionPolicy
+    metadata:
+      namespace: default
+      name: policy-for-httproute
+    spec:
+      targetRef:
+        group: gateway.networking.k8s.io
+        kind: HTTPRoute
+        name: httproute-1
+      extProc:
+        - backendRefs:
+            - name: backend-fqdn2
+              kind: Backend
+              port: 9090
+          backendSettings:
+            dns:
+              dnsRefreshRate: "5s"
+              lookupFamily: IPv4AndIPv6
+securityPolicies:
+  - apiVersion: gateway.envoyproxy.io/v1alpha1
+    kind: SecurityPolicy
+    metadata:
+      namespace: envoy-gateway
+      name: policy-for-gateway-1
+    spec:
+      targetRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+      extAuth:
+        http:
+          backendRefs:
+            - name: backend-fqdn3
+              namespace: default
+              Kind: Backend
+              port: 8080
+          backendSettings:
+            dns:
+              dnsRefreshRate: 30s
+              lookupFamily: IPv4Preferred
+        failOpen: false
+        bodyToExtAuth:
+          maxRequestBytes: 8192
+referenceGrants:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: ReferenceGrant
+    metadata:
+      name: allow-backends
+      namespace: default
+    spec:
+      from:
+        - group: gateway.envoyproxy.io
+          kind: SecurityPolicy
+          namespace: envoy-gateway
+      to:
+        - group: ""
+          kind: Backend
+          name: backend-fqdn3
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-dns-lookup-family.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-dns-lookup-family.out.yaml
new file mode 100644
index 000000000..7e067b8ea
--- /dev/null
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-dns-lookup-family.out.yaml
@@ -0,0 +1,492 @@
+backendTrafficPolicies:
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: backend-traffic-policy
+    namespace: default
+  spec:
+    dns:
+      dnsRefreshRate: 5s
+      lookupFamily: IPv6
+      respectDnsTtl: false
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: GRPCRoute
+      name: grpcroute-1
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+backends:
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: Backend
+  metadata:
+    creationTimestamp: null
+    name: backend-fqdn2
+    namespace: default
+  spec:
+    endpoints:
+    - fqdn:
+        hostname: backend-v2.gateway-conformance-infra.svc.cluster.local
+        port: 9090
+  status:
+    conditions:
+    - lastTransitionTime: null
+      message: The Backend was accepted
+      reason: Accepted
+      status: "True"
+      type: Accepted
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: Backend
+  metadata:
+    creationTimestamp: null
+    name: backend-fqdn
+    namespace: default
+  spec:
+    endpoints:
+    - fqdn:
+        hostname: grpc-infra-backend.gateway-conformance-infra.svc.cluster.local
+        port: 8080
+  status:
+    conditions:
+    - lastTransitionTime: null
+      message: The Backend was accepted
+      reason: Accepted
+      status: "True"
+      type: Accepted
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: Backend
+  metadata:
+    creationTimestamp: null
+    name: backend-fqdn3
+    namespace: default
+  spec:
+    endpoints:
+    - fqdn:
+        hostname: backend-v3.gateway-conformance-infra.svc.cluster.local
+        port: 8080
+  status:
+    conditions:
+    - lastTransitionTime: null
+      message: The Backend was accepted
+      reason: Accepted
+      status: "True"
+      type: Accepted
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: Backend
+  metadata:
+    creationTimestamp: null
+    name: backend-fqdn
+    namespace: default
+  spec:
+    endpoints:
+    - fqdn:
+        hostname: grpc-infra-backend-v1.gateway-conformance-infra.svc.cluster.local
+        port: 8080
+  status:
+    conditions:
+    - lastTransitionTime: null
+      message: The Backend was accepted
+      reason: Accepted
+      status: "True"
+      type: Accepted
+envoyExtensionPolicies:
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: EnvoyExtensionPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-httproute
+    namespace: default
+  spec:
+    extProc:
+    - backendRefs:
+      - kind: Backend
+        name: backend-fqdn2
+        port: 9090
+      backendSettings:
+        dns:
+          dnsRefreshRate: 5s
+          lookupFamily: IPv4AndIPv6
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - kind: Backend
+        name: backend-fqdn
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - gateway.envoyproxy.io
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - kind: Backend
+        name: backend-fqdn
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      config:
+        apiVersion: gateway.envoyproxy.io/v1alpha1
+        kind: EnvoyProxy
+        metadata:
+          creationTimestamp: null
+          name: config-for-gateway-class
+          namespace: envoy-gateway
+        spec:
+          logging: {}
+          telemetry:
+            accessLog:
+              settings:
+              - format:
+                  text: |
+                    [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
+                  type: Text
+                sinks:
+                - file:
+                    path: /dev/stdout
+                  type: File
+                - openTelemetry:
+                    backendRefs:
+                    - kind: Service
+                      name: logs
+                      namespace: default
+                      port: 8080
+                    backendSettings:
+                      dns:
+                        dnsRefreshRate: 30s
+                        lookupFamily: IPv4AndIPv6
+                    resources:
+                      k8s.cluster.name: cluster-1
+                  type: OpenTelemetry
+        status: {}
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http-80
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          gateway.envoyproxy.io/owning-gateway-name: gateway-1
+          gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+securityPolicies:
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway-1
+    namespace: envoy-gateway
+  spec:
+    extAuth:
+      bodyToExtAuth:
+        maxRequestBytes: 8192
+      failOpen: false
+      http:
+        backendRefs:
+        - kind: Backend
+          name: backend-fqdn3
+          namespace: default
+          port: 8080
+        backendSettings:
+          dns:
+            dnsRefreshRate: 30s
+            lookupFamily: IPv4Preferred
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      openTelemetry:
+      - destination:
+          name: accesslog_otel_0_1
+          settings:
+          - name: accesslog_otel_0_1/backend/-1
+            protocol: TCP
+        resources:
+          k8s.cluster.name: cluster-1
+        text: |
+          [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
+        traffic:
+          dns:
+            dnsRefreshRate: 30s
+            lookupFamily: IPv4AndIPv6
+      text:
+      - format: |
+          [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
+        path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      metadata:
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: FQDN
+            endpoints:
+            - host: grpc-infra-backend.gateway-conformance-infra.svc.cluster.local
+              port: 8080
+            name: httproute/default/httproute-1/rule/0/backend/0
+            protocol: HTTP
+            weight: 1
+        envoyExtensions:
+          extProcs:
+          - authority: backend-fqdn2.default:9090
+            destination:
+              name: envoyextensionpolicy/default/policy-for-httproute/extproc/0
+              settings:
+              - addressType: FQDN
+                endpoints:
+                - host: backend-v2.gateway-conformance-infra.svc.cluster.local
+                  port: 9090
+                name: envoyextensionpolicy/default/policy-for-httproute/extproc/0/backend/0
+                protocol: GRPC
+                weight: 1
+            name: envoyextensionpolicy/default/policy-for-httproute/extproc/0
+            traffic:
+              dns:
+                dnsRefreshRate: 5s
+                lookupFamily: IPv4AndIPv6
+        hostname: gateway.envoyproxy.io
+        isHTTP2: false
+        metadata:
+          kind: HTTPRoute
+          name: httproute-1
+          namespace: default
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        security:
+          extAuth:
+            bodyToExtAuth:
+              maxRequestBytes: 8192
+            failOpen: false
+            http:
+              authority: backend-v3.gateway-conformance-infra.svc.cluster.local:8080
+              destination:
+                name: securitypolicy/envoy-gateway/policy-for-gateway-1/extauth/0
+                settings:
+                - addressType: FQDN
+                  endpoints:
+                  - host: backend-v3.gateway-conformance-infra.svc.cluster.local
+                    port: 8080
+                  name: securitypolicy/envoy-gateway/policy-for-gateway-1/extauth/0/backend/0
+                  protocol: HTTP
+                  weight: 1
+              path: ""
+            name: securitypolicy/envoy-gateway/policy-for-gateway-1
+        traffic:
+          dns:
+            dnsRefreshRate: 5s
+            lookupFamily: IPv6
+            respectDnsTtl: false
+      - destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: FQDN
+            endpoints:
+            - host: grpc-infra-backend.gateway-conformance-infra.svc.cluster.local
+              port: 8080
+            name: grpcroute/default/grpcroute-1/rule/0/backend/0
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        metadata:
+          kind: GRPCRoute
+          name: grpcroute-1
+          namespace: default
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
+        security:
+          extAuth:
+            bodyToExtAuth:
+              maxRequestBytes: 8192
+            failOpen: false
+            http:
+              authority: backend-v3.gateway-conformance-infra.svc.cluster.local:8080
+              destination:
+                name: securitypolicy/envoy-gateway/policy-for-gateway-1/extauth/0
+                settings:
+                - addressType: FQDN
+                  endpoints:
+                  - host: backend-v3.gateway-conformance-infra.svc.cluster.local
+                    port: 8080
+                  name: securitypolicy/envoy-gateway/policy-for-gateway-1/extauth/0/backend/0
+                  protocol: HTTP
+                  weight: 1
+              path: ""
+            name: securitypolicy/envoy-gateway/policy-for-gateway-1
+        traffic:
+          dns:
+            dnsRefreshRate: 5s
+            lookupFamily: IPv6
+            respectDnsTtl: false
+    readyListener:
+      address: 0.0.0.0
+      ipFamily: IPv4
+      path: /ready
+      port: 19003
diff --git a/internal/xds/translator/testdata/in/xds-ir/dns-lookup-family.yaml b/internal/xds/translator/testdata/in/xds-ir/dns-lookup-family.yaml
new file mode 100644
index 000000000..82e8491aa
--- /dev/null
+++ b/internal/xds/translator/testdata/in/xds-ir/dns-lookup-family.yaml
@@ -0,0 +1,138 @@
+accessLog:
+  openTelemetry:
+    - destination:
+        name: accesslog_otel_0_1
+        settings:
+          - protocol: TCP
+      resources:
+        k8s.cluster.name: cluster-1
+      text: |
+        [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
+      traffic:
+        dns:
+          dnsRefreshRate: 30s
+          lookupFamily: IPv4
+  text:
+    - format: |
+        [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
+      path: /dev/stdout
+http:
+  - address: 0.0.0.0
+    hostnames:
+      - '*'
+    isHTTP2: true
+    metadata:
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    name: envoy-gateway/gateway-1/http
+    path:
+      escapedSlashesAction: UnescapeAndRedirect
+      mergeSlashes: true
+    port: 10080
+    routes:
+      - destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+            - addressType: FQDN
+              endpoints:
+                - host: grpc-infra-backend.gateway-conformance-infra.svc.cluster.local
+                  port: 8080
+              protocol: HTTP
+              weight: 1
+        envoyExtensions:
+          extProcs:
+            - authority: backend-fqdn2.default:9090
+              destination:
+                name: envoyextensionpolicy/default/policy-for-httproute/extproc/0
+                settings:
+                  - addressType: FQDN
+                    endpoints:
+                      - host: backend-v2.gateway-conformance-infra.svc.cluster.local
+                        port: 9090
+                    protocol: GRPC
+                    weight: 1
+              name: envoyextensionpolicy/default/policy-for-httproute/extproc/0
+              traffic:
+                dns:
+                  dnsRefreshRate: 5s
+                  lookupFamily: IPv4AndIPv6
+        hostname: gateway.envoyproxy.io
+        isHTTP2: false
+        metadata:
+          kind: HTTPRoute
+          name: httproute-1
+          namespace: default
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        security:
+          extAuth:
+            bodyToExtAuth:
+              maxRequestBytes: 8192
+            failOpen: false
+            http:
+              authority: backend-v3.gateway-conformance-infra.svc.cluster.local:8080
+              destination:
+                name: securitypolicy/envoy-gateway/policy-for-gateway-1/extauth/0
+                settings:
+                  - addressType: FQDN
+                    endpoints:
+                      - host: backend-v3.gateway-conformance-infra.svc.cluster.local
+                        port: 8080
+                    protocol: HTTP
+                    weight: 1
+              path: ""
+            name: securitypolicy/envoy-gateway/policy-for-gateway-1
+        traffic:
+          dns:
+            dnsRefreshRate: 5s
+            lookupFamily: IPv6
+            respectDnsTtl: false
+      - destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+            - addressType: FQDN
+              endpoints:
+                - host: grpc-infra-backend.gateway-conformance-infra.svc.cluster.local
+                  port: 8080
+              protocol: GRPC
+              weight: 1
+        hostname: '*'
+        isHTTP2: true
+        metadata:
+          kind: GRPCRoute
+          name: grpcroute-1
+          namespace: default
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
+        security:
+          extAuth:
+            bodyToExtAuth:
+              maxRequestBytes: 8192
+            failOpen: false
+            http:
+              authority: backend-v3.gateway-conformance-infra.svc.cluster.local:8080
+              destination:
+                name: securitypolicy/envoy-gateway/policy-for-gateway-1/extauth/0
+                settings:
+                  - addressType: FQDN
+                    endpoints:
+                      - host: backend-v3.gateway-conformance-infra.svc.cluster.local
+                        port: 8080
+                    protocol: HTTP
+                    weight: 1
+              path: ""
+            name: securitypolicy/envoy-gateway/policy-for-gateway-1
+        traffic:
+          dns:
+            dnsRefreshRate: 5s
+            lookupFamily: IPv6
+            respectDnsTtl: false
+readyListener:
+  address: 0.0.0.0
+  ipFamily: IPv4
+  path: /ready
+  port: 19003
diff --git a/internal/xds/translator/testdata/out/xds-ir/dns-lookup-family.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/dns-lookup-family.clusters.yaml
new file mode 100644
index 000000000..d7473a42f
--- /dev/null
+++ b/internal/xds/translator/testdata/out/xds-ir/dns-lookup-family.clusters.yaml
@@ -0,0 +1,130 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V6_ONLY
+  dnsRefreshRate: 5s
+  lbPolicy: LEAST_REQUEST
+  loadAssignment:
+    clusterName: httproute/default/httproute-1/rule/0
+    endpoints:
+    - lbEndpoints:
+      - endpoint:
+          address:
+            socketAddress:
+              address: grpc-infra-backend.gateway-conformance-infra.svc.cluster.local
+              portValue: 8080
+        loadBalancingWeight: 1
+      loadBalancingWeight: 1
+      locality: {}
+  name: httproute/default/httproute-1/rule/0
+  perConnectionBufferLimitBytes: 32768
+  type: STRICT_DNS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V6_ONLY
+  dnsRefreshRate: 5s
+  lbPolicy: LEAST_REQUEST
+  loadAssignment:
+    clusterName: grpcroute/default/grpcroute-1/rule/0
+    endpoints:
+    - lbEndpoints:
+      - endpoint:
+          address:
+            socketAddress:
+              address: grpc-infra-backend.gateway-conformance-infra.svc.cluster.local
+              portValue: 8080
+        loadBalancingWeight: 1
+      loadBalancingWeight: 1
+      locality: {}
+  name: grpcroute/default/grpcroute-1/rule/0
+  perConnectionBufferLimitBytes: 32768
+  type: STRICT_DNS
+  typedExtensionProtocolOptions:
+    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+      '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+      explicitHttpConfig:
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_PREFERRED
+  dnsRefreshRate: 30s
+  lbPolicy: LEAST_REQUEST
+  loadAssignment:
+    clusterName: securitypolicy/envoy-gateway/policy-for-gateway-1/extauth/0
+    endpoints:
+    - lbEndpoints:
+      - endpoint:
+          address:
+            socketAddress:
+              address: backend-v3.gateway-conformance-infra.svc.cluster.local
+              portValue: 8080
+        loadBalancingWeight: 1
+      loadBalancingWeight: 1
+      locality: {}
+  name: securitypolicy/envoy-gateway/policy-for-gateway-1/extauth/0
+  perConnectionBufferLimitBytes: 32768
+  respectDnsTtl: true
+  type: STRICT_DNS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: ALL
+  dnsRefreshRate: 5s
+  lbPolicy: LEAST_REQUEST
+  loadAssignment:
+    clusterName: envoyextensionpolicy/default/policy-for-httproute/extproc/0
+    endpoints:
+    - lbEndpoints:
+      - endpoint:
+          address:
+            socketAddress:
+              address: backend-v2.gateway-conformance-infra.svc.cluster.local
+              portValue: 9090
+        loadBalancingWeight: 1
+      loadBalancingWeight: 1
+      locality: {}
+  name: envoyextensionpolicy/default/policy-for-httproute/extproc/0
+  perConnectionBufferLimitBytes: 32768
+  respectDnsTtl: true
+  type: STRICT_DNS
+  typedExtensionProtocolOptions:
+    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+      '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+      explicitHttpConfig:
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  dnsRefreshRate: 30s
+  lbPolicy: LEAST_REQUEST
+  loadAssignment:
+    clusterName: accesslog_otel_0_1
+    endpoints:
+    - loadBalancingWeight: 1
+      locality: {}
+  name: accesslog_otel_0_1
+  perConnectionBufferLimitBytes: 32768
+  respectDnsTtl: true
+  type: STRICT_DNS
diff --git a/internal/xds/translator/testdata/out/xds-ir/dns-lookup-family.endpoints.yaml b/internal/xds/translator/testdata/out/xds-ir/dns-lookup-family.endpoints.yaml
new file mode 100644
index 000000000..fe51488c7
--- /dev/null
+++ b/internal/xds/translator/testdata/out/xds-ir/dns-lookup-family.endpoints.yaml
@@ -0,0 +1,1 @@
+[]
diff --git a/internal/xds/translator/testdata/out/xds-ir/dns-lookup-family.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/dns-lookup-family.listeners.yaml
new file mode 100644
index 000000000..cb9e09794
--- /dev/null
+++ b/internal/xds/translator/testdata/out/xds-ir/dns-lookup-family.listeners.yaml
@@ -0,0 +1,180 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 19003
+  bypassOverloadManager: true
+  filterChains:
+  - filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        httpFilters:
+        - name: envoy.filters.http.health_check
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+            headers:
+            - name: :path
+              stringMatch:
+                exact: /ready
+            passThroughMode: false
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        routeConfig:
+          name: ready_route
+          virtualHosts:
+          - domains:
+            - '*'
+            name: ready_route
+            routes:
+            - directResponse:
+                status: 500
+              match:
+                prefix: /
+        statPrefix: eg-ready-http
+  name: envoy-gateway-proxy-ready-0.0.0.0-19003
+- accessLog:
+  - filter:
+      responseFlagFilter:
+        flags:
+        - NR
+    name: envoy.access_loggers.file
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+      logFormat:
+        textFormatSource:
+          inlineString: |
+            [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
+      path: /dev/stdout
+  - filter:
+      responseFlagFilter:
+        flags:
+        - NR
+    name: envoy.access_loggers.open_telemetry
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.access_loggers.open_telemetry.v3.OpenTelemetryAccessLogConfig
+      attributes:
+        values:
+        - key: k8s.namespace.name
+          value:
+            stringValue: '%ENVIRONMENT(ENVOY_GATEWAY_NAMESPACE)%'
+        - key: k8s.pod.name
+          value:
+            stringValue: '%ENVIRONMENT(ENVOY_POD_NAME)%'
+      body:
+        stringValue: |
+          [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
+      commonConfig:
+        grpcService:
+          envoyGrpc:
+            clusterName: accesslog_otel_0_1
+        logName: otel_envoy_accesslog
+        transportApiVersion: V3
+      resourceAttributes:
+        values:
+        - key: k8s.cluster.name
+          value:
+            stringValue: cluster-1
+  address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        accessLog:
+        - name: envoy.access_loggers.file
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+            logFormat:
+              textFormatSource:
+                inlineString: |
+                  [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
+            path: /dev/stdout
+        - name: envoy.access_loggers.open_telemetry
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.access_loggers.open_telemetry.v3.OpenTelemetryAccessLogConfig
+            attributes:
+              values:
+              - key: k8s.namespace.name
+                value:
+                  stringValue: '%ENVIRONMENT(ENVOY_GATEWAY_NAMESPACE)%'
+              - key: k8s.pod.name
+                value:
+                  stringValue: '%ENVIRONMENT(ENVOY_POD_NAME)%'
+            body:
+              stringValue: |
+                [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
+            commonConfig:
+              grpcService:
+                envoyGrpc:
+                  clusterName: accesslog_otel_0_1
+              logName: otel_envoy_accesslog
+              transportApiVersion: V3
+            resourceAttributes:
+              values:
+              - key: k8s.cluster.name
+                value:
+                  stringValue: cluster-1
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - disabled: true
+          name: envoy.filters.http.ext_authz/securitypolicy/envoy-gateway/policy-for-gateway-1
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
+            httpService:
+              serverUri:
+                cluster: securitypolicy/envoy-gateway/policy-for-gateway-1/extauth/0
+                timeout: 10s
+                uri: http://backend-v3.gateway-conformance-infra.svc.cluster.local:8080
+            transportApiVersion: V3
+            withRequestBody:
+              maxRequestBytes: 8192
+        - name: envoy.filters.http.grpc_web
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.grpc_web.v3.GrpcWeb
+        - name: envoy.filters.http.grpc_stats
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.grpc_stats.v3.FilterConfig
+            emitFilterState: true
+            statsForAllMethods: true
+        - disabled: true
+          name: envoy.filters.http.ext_proc/envoyextensionpolicy/default/policy-for-httproute/extproc/0
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.ext_proc.v3.ExternalProcessor
+            grpcService:
+              envoyGrpc:
+                authority: backend-fqdn2.default:9090
+                clusterName: envoyextensionpolicy/default/policy-for-httproute/extproc/0
+              timeout: 10s
+            processingMode:
+              requestHeaderMode: SKIP
+              requestTrailerMode: SKIP
+              responseHeaderMode: SKIP
+              responseTrailerMode: SKIP
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        pathWithEscapedSlashesAction: UNESCAPE_AND_REDIRECT
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: envoy-gateway/gateway-1/http
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http-10080
+        useRemoteAddress: true
+    name: envoy-gateway/gateway-1/http
+  name: envoy-gateway/gateway-1/http
+  perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/dns-lookup-family.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/dns-lookup-family.routes.yaml
new file mode 100644
index 000000000..85624a835
--- /dev/null
+++ b/internal/xds/translator/testdata/out/xds-ir/dns-lookup-family.routes.yaml
@@ -0,0 +1,64 @@
+- ignorePortInHostMatching: true
+  name: envoy-gateway/gateway-1/http
+  virtualHosts:
+  - domains:
+    - gateway.envoyproxy.io
+    metadata:
+      filterMetadata:
+        envoy-gateway:
+          resources:
+          - kind: Gateway
+            name: gateway-1
+            namespace: envoy-gateway
+            sectionName: http
+    name: envoy-gateway/gateway-1/http/gateway_envoyproxy_io
+    routes:
+    - match:
+        prefix: /
+      metadata:
+        filterMetadata:
+          envoy-gateway:
+            resources:
+            - kind: HTTPRoute
+              name: httproute-1
+              namespace: default
+      name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+      route:
+        cluster: httproute/default/httproute-1/rule/0
+        upgradeConfigs:
+        - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.ext_authz/securitypolicy/envoy-gateway/policy-for-gateway-1:
+          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
+          config: {}
+        envoy.filters.http.ext_proc/envoyextensionpolicy/default/policy-for-httproute/extproc/0:
+          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
+          config: {}
+  - domains:
+    - '*'
+    metadata:
+      filterMetadata:
+        envoy-gateway:
+          resources:
+          - kind: Gateway
+            name: gateway-1
+            namespace: envoy-gateway
+            sectionName: http
+    name: envoy-gateway/gateway-1/http/*
+    routes:
+    - match:
+        prefix: /
+      metadata:
+        filterMetadata:
+          envoy-gateway:
+            resources:
+            - kind: GRPCRoute
+              name: grpcroute-1
+              namespace: default
+      name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
+      route:
+        cluster: grpcroute/default/grpcroute-1/rule/0
+      typedPerFilterConfig:
+        envoy.filters.http.ext_authz/securitypolicy/envoy-gateway/policy-for-gateway-1:
+          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
+          config: {}
diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md
index 47972765e..3d309ad68 100644
--- a/site/content/en/latest/api/extension_types.md
+++ b/site/content/en/latest/api/extension_types.md
@@ -984,6 +984,7 @@ _Appears in:_
 | ---   | ---  | ---      | ---     | ---         |
 | `dnsRefreshRate` | _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#duration-v1-meta)_ |  true  |  | DNSRefreshRate specifies the rate at which DNS records should be refreshed.<br />Defaults to 30 seconds. |
 | `respectDnsTtl` | _boolean_ |  true  |  | RespectDNSTTL indicates whether the DNS Time-To-Live (TTL) should be respected.<br />If the value is set to true, the DNS refresh rate will be set to the resource record’s TTL.<br />Defaults to true. |
+| `lookupFamily` | _[DNSLookupFamily](#dnslookupfamily)_ |  false  |  | LookupFamily determines how Envoy would resolve DNS for Routes where the backend is specified as a fully qualified domain name (FQDN).<br />If set, this configuration overrides other defaults. |
 
 
 #### DNSLookupFamily