My core dns is in docker network mode host. So docker does not open iptables for the world to reach my dns. It listen to all interfaces.