from
the application. Envoy can now clearly distinguish traffic bound for
each external TCP service and forward it to the right target. With the
introduction of the DNS proxying, you will no longer need to use
<code>resolution: NONE</code> for non-wildcard TCP services, improving your
overall security posture. Istio cannot help much with wildcard
external services (e.g., <code>*.us-east1.rds.amazonaws.com</code>). You will
have to resort to NONE resolution mode to handle such services.</p><h3 id=multicluste