diff --git a/tracks/cka/bank_extra.py b/tracks/cka/bank_extra.py
index ced4a24..6800475 100644
--- a/tracks/cka/bank_extra.py
+++ b/tracks/cka/bank_extra.py
@@ -580,8 +580,9 @@ $K -n %{ns} delete pvc old-claim >/dev/null
  "params": lambda r: {"bad": r.choice(["forward . 10.255.255.1", "forward . 192.0.2.53"])},
  "task": """
 Pods across the cluster can no longer resolve names (in-cluster or external).
-Find the cause in CoreDNS and fix it. `nslookup kubernetes.default` from any pod must work
-again, and CoreDNS must be healthy.
+Find the cause in CoreDNS and fix it. `nslookup kubernetes.default.svc.cluster.local` and
+`nslookup kubernetes.io` from any pod must work again, and CoreDNS must be healthy.
+(Use the FQDN: busybox's nslookup does not apply the pod's `search` domains.)
 """,
  "setup": r"""
 $K -n kube-system get cm coredns -o jsonpath='{.data.Corefile}' > /tmp/Corefile.orig
@@ -594,7 +595,7 @@ $K -n kube-system rollout restart deploy coredns >/dev/null
   C("CoreDNS pods available", 1, r"""[ "$(j -n kube-system deploy coredns '{.status.availableReplicas}')" -ge 1 ]"""),
   C("in-cluster and external names resolve from a pod", 3, r"""
 $K -n default delete pod dns-probe --ignore-not-found --wait=true >/dev/null 2>&1
-$K -n default run dns-probe --image=busybox:1.36 --restart=Never -- sh -c 'for i in 1 2 3 4 5 6; do nslookup kubernetes.default >/dev/null 2>&1 && nslookup kubernetes.io >/dev/null 2>&1 && echo OK && exit 0; sleep 5; done; exit 1' >/dev/null 2>&1
+$K -n default run dns-probe --image=busybox:1.36 --restart=Never -- sh -c 'for i in 1 2 3 4 5 6; do nslookup kubernetes.default.svc.cluster.local >/dev/null 2>&1 && nslookup kubernetes.io >/dev/null 2>&1 && echo OK && exit 0; sleep 5; done; exit 1' >/dev/null 2>&1
 for i in $(seq 1 20); do ph=$(j -n default pod dns-probe '{.status.phase}'); [ "$ph" = Succeeded ] && { $K -n default delete pod dns-probe --wait=false >/dev/null; exit 0; }; [ "$ph" = Failed ] && break; sleep 3; done
 $K -n default delete pod dns-probe --wait=false >/dev/null; exit 1"""),
  ],
diff --git a/tracks/cka/bank_hard.py b/tracks/cka/bank_hard.py
index b348f5a..77c7b5f 100644
--- a/tracks/cka/bank_hard.py
+++ b/tracks/cka/bank_hard.py
@@ -470,8 +470,10 @@ sys.exit(0 if ok else 1)'"""),
  "params": lambda r: {"ctx": "k8s-c1-H"},
  "task": CTX + """
 Nothing in the cluster resolves DNS. Restore it. There is more than one cause.
-When done, `nslookup kubernetes.default` and `nslookup kubernetes.io` must succeed from a pod
-in `default`, CoreDNS must have 2 available replicas, and no NetworkPolicy may remain in `kube-system`.
+When done, `nslookup kubernetes.default.svc.cluster.local` and `nslookup kubernetes.io` must
+succeed from a pod in `default` (use the FQDN: busybox's nslookup does not apply the pod's
+`search` domains), CoreDNS must have 2 available replicas, and no NetworkPolicy may remain in
+`kube-system`.
 """,
  "setup": r"""
 $K -n kube-system get cm coredns -o jsonpath='{.data.Corefile}' > /tmp/Corefile.q114
@@ -491,7 +493,7 @@ EOF
   C("no NetworkPolicy in kube-system", 1, r"""[ "$($K -n kube-system get netpol --no-headers 2>/dev/null | wc -l)" = 0 ]"""),
   C("resolution works from a pod", 3, r"""
 $K -n default delete pod dns-probe --ignore-not-found --wait=true >/dev/null 2>&1
-$K -n default run dns-probe --image=busybox:1.36 --restart=Never -- sh -c 'for i in 1 2 3 4 5 6; do nslookup kubernetes.default >/dev/null 2>&1 && nslookup kubernetes.io >/dev/null 2>&1 && exit 0; sleep 5; done; exit 1' >/dev/null 2>&1
+$K -n default run dns-probe --image=busybox:1.36 --restart=Never -- sh -c 'for i in 1 2 3 4 5 6; do nslookup kubernetes.default.svc.cluster.local >/dev/null 2>&1 && nslookup kubernetes.io >/dev/null 2>&1 && exit 0; sleep 5; done; exit 1' >/dev/null 2>&1
 for i in $(seq 1 20); do ph=$(j -n default pod dns-probe '{.status.phase}'); [ "$ph" = Succeeded ] && { $K -n default delete pod dns-probe --wait=false >/dev/null; exit 0; }; [ "$ph" = Failed ] && break; sleep 3; done
 $K -n default delete pod dns-probe --wait=false >/dev/null; exit 1"""),
  ],