diff --git a/docs/usages/configuration.md b/docs/usages/configuration.md
index ccd992aa..773e7190 100644
--- a/docs/usages/configuration.md
+++ b/docs/usages/configuration.md
@@ -122,6 +122,50 @@ At least one join or Azure authentication method must be configured. `azure.boot
 |------|------|-------------|--------------|
 | `networking.dnsServiceIP` | string | Cluster DNS service IP. | `10.0.0.10` |
 | `networking.cniVersion` | string | Optional CNI plugin version override. | `v1.6.2` |
+| `networking.localDNS` | object | Optional AKS LocalDNS profile using the same `mode`, `vnetDNSOverrides`, and `kubeDNSOverrides` shape accepted by `az aks nodepool --localdns-config`. | `{ "mode": "Required" }` |
+
+### AKS LocalDNS
+
+AKS Flex Node accepts the official AKS LocalDNS JSON profile under
+`networking.localDNS`. See [Configure LocalDNS in
+AKS](https://learn.microsoft.com/azure/aks/localdns-custom) for the supported
+fields and values. `Required` enables LocalDNS, `Disabled` disables it through
+repave, and `Preferred` validates the profile without enabling the service.
+
+```json
+{
+  "networking": {
+    "dnsServiceIP": "10.0.0.10",
+    "localDNS": {
+      "mode": "Required",
+      "vnetDNSOverrides": {
+        ".": {
+          "queryLogging": "Error",
+          "protocol": "PreferUDP",
+          "forwardDestination": "VnetDNS",
+          "forwardPolicy": "Sequential",
+          "maxConcurrent": 1000,
+          "cacheDurationInSeconds": 3600,
+          "serveStaleDurationInSeconds": 3600,
+          "serveStale": "Immediate"
+        }
+      },
+      "kubeDNSOverrides": {
+        ".": {
+          "queryLogging": "Error",
+          "protocol": "ForceTCP",
+          "forwardDestination": "ClusterCoreDNS",
+          "forwardPolicy": "Sequential",
+          "maxConcurrent": 1000,
+          "cacheDurationInSeconds": 3600,
+          "serveStaleDurationInSeconds": 3600,
+          "serveStale": "Immediate"
+        }
+      }
+    }
+  }
+}
+```
 
 ## Node
 
diff --git a/hack/e2e/infra/main.bicep b/hack/e2e/infra/main.bicep
index a07e5984..ec44699d 100644
--- a/hack/e2e/infra/main.bicep
+++ b/hack/e2e/infra/main.bicep
@@ -236,6 +236,7 @@ output clusterFqdn string = aksCluster.properties.fqdn
 
 output msiVmName string = vmMsi.outputs.vmName
 output msiVmIp string = vmMsi.outputs.publicIpAddress
+output msiVmPrivateIp string = vmMsi.outputs.privateIpAddress
 output msiVmPrincipalId string = vmMsi.outputs.principalId
 
 output tokenVmName string = vmToken.outputs.vmName
diff --git a/hack/e2e/lib/infra.sh b/hack/e2e/lib/infra.sh
index cc3d457b..d7ba0224 100755
--- a/hack/e2e/lib/infra.sh
+++ b/hack/e2e/lib/infra.sh
@@ -107,7 +107,7 @@ infra_deploy() {
     --query properties.outputs \
     -o json)
 
-  local cluster_name cluster_id msi_vm_name msi_vm_ip msi_vm_principal_id
+  local cluster_name cluster_id msi_vm_name msi_vm_ip msi_vm_private_ip msi_vm_principal_id
   local token_vm_name token_vm_ip token_vm_private_ip offline_vm_name offline_vm_ip offline_vm_private_ip
   local kubeadm_vm_name kubeadm_vm_ip admin_username
 
@@ -115,6 +115,7 @@ infra_deploy() {
   cluster_id=$(echo "${outputs}"      | jq -r '.clusterId.value')
   msi_vm_name=$(echo "${outputs}"     | jq -r '.msiVmName.value')
   msi_vm_ip=$(echo "${outputs}"       | jq -r '.msiVmIp.value')
+  msi_vm_private_ip=$(echo "${outputs}" | jq -r '.msiVmPrivateIp.value // ""')
   msi_vm_principal_id=$(echo "${outputs}" | jq -r '.msiVmPrincipalId.value')
   token_vm_name=$(echo "${outputs}"   | jq -r '.tokenVmName.value')
   token_vm_ip=$(echo "${outputs}"     | jq -r '.tokenVmIp.value')
@@ -126,6 +127,10 @@ infra_deploy() {
   kubeadm_vm_ip=$(echo "${outputs}"   | jq -r '.kubeadmVmIp.value')
   admin_username=$(echo "${outputs}"  | jq -r '.adminUsername.value')
 
+  if [[ -z "${msi_vm_private_ip}" ]] || ! is_valid_ipv4 "${msi_vm_private_ip}"; then
+    log_error "Missing or invalid MSI VM private IP from deployment outputs: '${msi_vm_private_ip}'"
+    return 1
+  fi
   if [[ -z "${token_vm_private_ip}" ]] || ! is_valid_ipv4 "${token_vm_private_ip}"; then
     log_error "Missing or invalid token VM private IP from deployment outputs: '${token_vm_private_ip}'"
     return 1
@@ -140,6 +145,7 @@ infra_deploy() {
   state_set "cluster_id"           "${cluster_id}"
   state_set "msi_vm_name"          "${msi_vm_name}"
   state_set "msi_vm_ip"            "${msi_vm_ip}"
+  state_set "msi_vm_private_ip"    "${msi_vm_private_ip}"
   state_set "msi_vm_principal_id"  "${msi_vm_principal_id}"
   state_set "token_vm_name"        "${token_vm_name}"
   state_set "token_vm_ip"          "${token_vm_ip}"
diff --git a/hack/e2e/lib/node-join-msi.sh b/hack/e2e/lib/node-join-msi.sh
index e9167574..6a94715e 100644
--- a/hack/e2e/lib/node-join-msi.sh
+++ b/hack/e2e/lib/node-join-msi.sh
@@ -14,6 +14,63 @@ readonly _E2E_NODE_JOIN_MSI_LOADED=1
 # shellcheck disable=SC1091
 source "$(dirname "${BASH_SOURCE[0]}")/common.sh"
 
+# ---------------------------------------------------------------------------
+# prepare_localdns_host_resolver - Remove DHCP search/routing domains.
+#
+# Unbounded intentionally rejects systemd-resolved split-DNS layouts because
+# flattening per-domain routing into one LocalDNS upstream list changes DNS
+# semantics. Azure's Ubuntu image supplies a DHCP search domain by default, so
+# put the disposable E2E host into the supported single-upstream layout before
+# LocalDNS preflight runs.
+# ---------------------------------------------------------------------------
+prepare_localdns_host_resolver() {
+  local vm_ip="$1"
+
+  log_info "Configuring the MSI host resolver for LocalDNS..."
+  remote_exec "${vm_ip}" "sudo bash -s" <<'REMOTE'
+set -euo pipefail
+
+interface="$(ip -4 route show default | awk 'NR == 1 { print $5 }')"
+if [[ ! "${interface}" =~ ^[a-zA-Z0-9_.:-]+$ ]]; then
+  echo "could not determine a safe primary interface name: ${interface}" >&2
+  exit 1
+fi
+
+cat > /etc/netplan/99-aks-flex-localdns.yaml <<EOF
+network:
+  version: 2
+  ethernets:
+    ${interface}:
+      dhcp4-overrides:
+        use-domains: false
+EOF
+chmod 0600 /etc/netplan/99-aks-flex-localdns.yaml
+netplan generate
+netplan apply
+
+# Match Unbounded's supported-domain rule: no domain is allowed except the
+# catch-all routing domain (~.).
+if resolvectl domain | awk -F: '
+  {
+    for (i = 2; i <= NF; i++) {
+      count = split($i, domains, /[[:space:]]+/)
+      for (j = 1; j <= count; j++)
+        if (domains[j] != "" && domains[j] != "~.")
+          found = 1
+    }
+  }
+  END { exit !found }
+'; then
+  echo "unsupported systemd-resolved domain remains after netplan apply:" >&2
+  resolvectl domain >&2
+  exit 1
+fi
+
+resolvectl domain
+resolvectl dns "${interface}"
+REMOTE
+}
+
 # ---------------------------------------------------------------------------
 # node_join_msi - Join the MSI VM
 # ---------------------------------------------------------------------------
@@ -24,6 +81,8 @@ node_join_msi() {
 
   local vm_ip
   vm_ip="$(state_get msi_vm_ip)"
+  local vm_private_ip
+  vm_private_ip="$(state_get msi_vm_private_ip)"
   local cluster_id
   cluster_id="$(state_get cluster_id)"
   local subscription_id
@@ -55,7 +114,8 @@ node_join_msi() {
   "node": {
     "kubelet": {
       "clusterFQDN": "${server_url}",
-      "caCertData": "${ca_cert_data}"
+      "caCertData": "${ca_cert_data}",
+      "nodeIP": "${vm_private_ip}"
     }
   },
   "agent": {
@@ -67,6 +127,35 @@ node_join_msi() {
     },
     "requireMachineRegistration": true
   },
+  "networking": {
+    "localDNS": {
+      "mode": "Required",
+      "vnetDNSOverrides": {
+        ".": {
+          "queryLogging": "Error",
+          "protocol": "PreferUDP",
+          "forwardDestination": "VnetDNS",
+          "forwardPolicy": "Sequential",
+          "maxConcurrent": 1000,
+          "cacheDurationInSeconds": 3600,
+          "serveStaleDurationInSeconds": 3600,
+          "serveStale": "Immediate"
+        }
+      },
+      "kubeDNSOverrides": {
+        ".": {
+          "queryLogging": "Error",
+          "protocol": "ForceTCP",
+          "forwardDestination": "ClusterCoreDNS",
+          "forwardPolicy": "Sequential",
+          "maxConcurrent": 1000,
+          "cacheDurationInSeconds": 3600,
+          "serveStaleDurationInSeconds": 3600,
+          "serveStale": "Immediate"
+        }
+      }
+    }
+  },
   "components": {
     "kubernetes": "${E2E_KUBERNETES_VERSION}",
     "containerd": "${E2E_CONTAINERD_VERSION}",
@@ -75,7 +164,10 @@ node_join_msi() {
 }
 EOF
 
-  # Step 2: Publish the AKS Machine goal and deploy the agent.
+  # Step 2: Put systemd-resolved into the layout supported by LocalDNS.
+  prepare_localdns_host_resolver "${vm_ip}"
+
+  # Step 3: Publish the AKS Machine goal and deploy the agent.
   ensure_flex_controller
   machine_configmap_upsert "$(state_get msi_vm_name)" "${E2E_KUBERNETES_VERSION}" "${E2E_KUBERNETES_VERSION}"
   _deploy_and_start_agent "${vm_ip}" "${config_file}" "aks-flex-node-msi"
diff --git a/hack/e2e/lib/upgrade-drift.sh b/hack/e2e/lib/upgrade-drift.sh
index f1be588f..24f9478e 100644
--- a/hack/e2e/lib/upgrade-drift.sh
+++ b/hack/e2e/lib/upgrade-drift.sh
@@ -209,11 +209,69 @@ upgrade_drift_mode() {
   log_success "${mode} controller machine repave passed in $(timer_elapsed "${start}")s"
 }
 
+localdns_disable_repave_msi() {
+  log_section "LocalDNS Disable Repave (MSI node)"
+  local desired_version settings_version vm_name vm_ip snapshot old_active_machine old_state old_version old_settings_version old_node_uid
+  desired_version="$(_cluster_current_kubernetes_version)"
+  settings_version="localdns-disabled-$(date +%s)"
+  vm_name="$(_mode_vm_name msi)"
+  vm_ip="$(_mode_vm_ip msi)"
+
+  snapshot="$(_remote_active_machine_snapshot "${vm_ip}")"
+  IFS='|' read -r old_active_machine old_state old_version old_settings_version <<<"${snapshot}"
+  old_node_uid="$(kubectl get node "${vm_name}" -o jsonpath='{.metadata.uid}')"
+
+  remote_exec "${vm_ip}" "sudo bash -s" <<'REMOTE'
+set -euo pipefail
+config=/etc/aks-flex-node/config.json
+tmp=$(mktemp /etc/aks-flex-node/config.json.XXXXXX)
+jq '.networking.localDNS.mode = "Disabled"' "${config}" > "${tmp}"
+chmod 0600 "${tmp}"
+mv "${tmp}" "${config}"
+systemctl restart aks-flex-node-agent.service
+systemctl is-active --quiet aks-flex-node-agent.service
+REMOTE
+
+  _trigger_mode_repave msi "${desired_version}" "${settings_version}"
+  _wait_for_mode_repave msi "${desired_version}" "${settings_version}" "${old_active_machine}" "${old_node_uid}"
+
+  local cluster_dns
+  cluster_dns="$(kubectl -n kube-system get service kube-dns -o jsonpath='{.spec.clusterIP}')"
+
+  remote_exec "${vm_ip}" "CLUSTER_DNS=${cluster_dns} sudo -E bash -s" <<'REMOTE'
+set -euo pipefail
+machine=$(machinectl list --no-legend | awk '$1 ~ /^kube[12]$/ {print $1; exit}')
+test -n "${machine}"
+if systemd-run --quiet --pipe --wait --machine="${machine}" systemctl cat localdns.service >/dev/null 2>&1; then
+  echo "localdns.service still exists after disabling LocalDNS" >&2
+  exit 1
+fi
+if ip link show localdns >/dev/null 2>&1; then
+  echo "localdns interface still exists after disabling LocalDNS" >&2
+  exit 1
+fi
+if nft list table ip unbounded_localdns >/dev/null 2>&1; then
+  echo "unbounded_localdns nftables table still exists after disabling LocalDNS" >&2
+  exit 1
+fi
+systemd-run --quiet --pipe --wait --machine="${machine}" \
+  awk -v expected="${CLUSTER_DNS}" '
+    $1 == "clusterDNS:" { in_cluster_dns = 1; next }
+    in_cluster_dns && $1 == "-" && $2 == expected { found = 1 }
+    in_cluster_dns && $1 != "-" { in_cluster_dns = 0 }
+    END { exit !found }
+  ' /var/lib/kubelet/config.yaml
+REMOTE
+
+  log_success "MSI LocalDNS disable-through-repave validation passed"
+}
+
 upgrade_drift_all() {
   log_section "Controller Machine Repave (all modes)"
   upgrade_drift_mode msi
   upgrade_drift_mode token
   upgrade_drift_mode kubeadm
+  localdns_disable_repave_msi
 }
 
 upgrade_drift_msi() { upgrade_drift_mode msi; }
diff --git a/hack/e2e/lib/validate.sh b/hack/e2e/lib/validate.sh
index 02ab9f6c..0857bbfc 100755
--- a/hack/e2e/lib/validate.sh
+++ b/hack/e2e/lib/validate.sh
@@ -6,6 +6,8 @@
 #   validate_node_joined  <vm_name>  - Wait for a specific node to appear in kubectl
 #   validate_all_nodes                - Verify MSI, token, offline, and kubeadm nodes joined
 #   validate_npd_status   <vm_name> <vm_ip> - Verify node-problem-detector is active
+#   validate_localdns_status <vm_name> <vm_ip> - Verify LocalDNS behavior
+#   validate_localdns_after_reboot <vm_name> <vm_ip> - Verify LocalDNS after nspawn reboot
 #   validate_node_absent  <vm_name>  - Wait for a node to disappear from kubectl
 #   validate_all_nodes_absent         - Verify all flex nodes are gone after unjoin
 #   smoke_test            <vm_name> <label>  - Schedule an nginx pod on a node
@@ -15,6 +17,7 @@ set -euo pipefail
 
 [[ -n "${_E2E_VALIDATE_LOADED:-}" ]] && return 0
 readonly _E2E_VALIDATE_LOADED=1
+_E2E_LOCALDNS_REBOOT_VALIDATED=0
 
 # shellcheck disable=SC1091
 source "$(dirname "${BASH_SOURCE[0]}")/common.sh"
@@ -168,6 +171,121 @@ REMOTE
 }
 
 # ---------------------------------------------------------------------------
+# validate_localdns_status - Verify nspawn LocalDNS on the selected VM.
+validate_localdns_status() {
+  local vm_name="$1"
+  local vm_ip="$2"
+  log_info "Validating LocalDNS on ${vm_ip}..."
+  remote_exec "${vm_ip}" "sudo bash -s" <<'REMOTE'
+set -euo pipefail
+machine=$(sudo machinectl list --no-legend | awk '$1 ~ /^kube[12]$/ {print $1; exit}')
+test -n "${machine}"
+sudo systemd-run --quiet --pipe --wait --machine="${machine}" systemctl is-active --quiet localdns.service
+sudo systemd-run --quiet --pipe --wait --machine="${machine}" \
+  grep -qx 'nameserver 169.254.10.10' /etc/unbounded/localdns/resolv.conf
+sudo systemd-run --quiet --pipe --wait --machine="${machine}" \
+  systemctl cat kubelet.service | grep -q -- '--resolv-conf=/etc/unbounded/localdns/resolv.conf'
+sudo ip address show dev localdns | grep -q '169.254.10.10/32'
+sudo ip address show dev localdns | grep -q '169.254.10.11/32'
+for chain in output prerouting; do
+  rules="$(sudo nft list chain ip unbounded_localdns "${chain}")"
+  for address in 169.254.10.10 169.254.10.11; do
+    for protocol in tcp udp; do
+      grep -Fq \
+        "ip daddr ${address} ${protocol} dport 53 notrack comment \"unbounded-localdns: skip conntrack\"" \
+        <<<"${rules}"
+    done
+  done
+done
+REMOTE
+
+  local cluster_pod="localdns-clusterfirst-${vm_name}"
+  local default_pod="localdns-default-${vm_name}"
+  kubectl delete pod "${cluster_pod}" "${default_pod}" --ignore-not-found --wait=true >/dev/null
+  kubectl run "${cluster_pod}" --image=busybox:1.36 --restart=Never \
+    --overrides="{\"spec\":{\"nodeName\":\"${vm_name}\",\"dnsPolicy\":\"ClusterFirst\"}}" \
+    --command -- nslookup kubernetes.default.svc.cluster.local >/dev/null
+  kubectl run "${default_pod}" --image=busybox:1.36 --restart=Never \
+    --overrides="{\"spec\":{\"nodeName\":\"${vm_name}\",\"dnsPolicy\":\"Default\"}}" \
+    --command -- nslookup mcr.microsoft.com >/dev/null
+
+  local pod
+  for pod in "${cluster_pod}" "${default_pod}"; do
+    local phase=""
+    for _ in $(seq 1 60); do
+      phase="$(kubectl get pod "${pod}" -o jsonpath='{.status.phase}' 2>/dev/null || true)"
+      [[ "${phase}" == "Succeeded" || "${phase}" == "Failed" ]] && break
+      sleep 2
+    done
+    if [[ "${phase}" != "Succeeded" ]]; then
+      kubectl describe pod "${pod}" >&2 || true
+      kubectl logs "${pod}" >&2 || true
+      log_error "LocalDNS query pod ${pod} ended in phase ${phase}"
+      return 1
+    fi
+  done
+
+  if ! kubectl logs "${cluster_pod}" | grep -Eq 'Server:[[:space:]]*169\.254\.10\.11'; then
+    log_error "ClusterFirst pod did not query LocalDNS cluster listener"
+    return 1
+  fi
+  if ! kubectl logs "${default_pod}" | grep -Eq 'Server:[[:space:]]*169\.254\.10\.10'; then
+    log_error "Default-policy pod did not query LocalDNS node listener"
+    return 1
+  fi
+  kubectl delete pod "${cluster_pod}" "${default_pod}" --ignore-not-found --wait=false >/dev/null
+
+  log_success "LocalDNS validation passed on ${vm_ip}"
+}
+
+# validate_localdns_after_reboot - Verify LocalDNS survives an nspawn reboot.
+# ---------------------------------------------------------------------------
+validate_localdns_after_reboot() {
+  local vm_name="$1"
+  local vm_ip="$2"
+  local old_renew_time
+  old_renew_time="$(kubectl -n kube-node-lease get lease "${vm_name}" -o jsonpath='{.spec.renewTime}')"
+
+  log_section "Validating LocalDNS After Nspawn Reboot"
+  log_info "Rebooting the nspawn machine on ${vm_name} (${vm_ip})..."
+  remote_exec "${vm_ip}" "sudo bash -s" <<'REMOTE' || return 1
+set -euo pipefail
+machine=$(machinectl list --no-legend | awk '$1 ~ /^kube[12]$/ {print $1; exit}')
+test -n "${machine}"
+machinectl reboot "${machine}"
+for _ in $(seq 1 60); do
+  if systemd-run --quiet --pipe --wait --machine="${machine}" \
+      systemctl is-active --quiet localdns.service kubelet.service containerd.service >/dev/null 2>&1; then
+    exit 0
+  fi
+  sleep 5
+done
+machinectl status "${machine}" >&2 || true
+systemd-run --quiet --pipe --wait --machine="${machine}" \
+  systemctl --no-pager --full status localdns.service kubelet.service containerd.service >&2 || true
+exit 1
+REMOTE
+
+  local timeout="${E2E_NODE_JOIN_TIMEOUT}"
+  local elapsed=0
+  while [[ "${elapsed}" -lt "${timeout}" ]]; do
+    local ready renew_time
+    ready="$(kubectl get node "${vm_name}" -o jsonpath='{.status.conditions[?(@.type=="Ready")].status}' 2>/dev/null || true)"
+    renew_time="$(kubectl -n kube-node-lease get lease "${vm_name}" -o jsonpath='{.spec.renewTime}' 2>/dev/null || true)"
+    if [[ "${ready}" == "True" && -n "${renew_time}" && "${renew_time}" != "${old_renew_time}" ]]; then
+      validate_localdns_status "${vm_name}" "${vm_ip}" || return 1
+      log_success "LocalDNS recovered after nspawn reboot on ${vm_name}"
+      return 0
+    fi
+    sleep 5
+    elapsed=$((elapsed + 5))
+  done
+
+  log_error "Node ${vm_name} did not renew its lease and become Ready after nspawn reboot"
+  kubectl describe node "${vm_name}" >&2 || true
+  return 1
+}
+
 # validate_all_nodes - Check all MSI, token, offline, and kubeadm VMs joined
 # ---------------------------------------------------------------------------
 validate_all_nodes() {
@@ -186,12 +304,13 @@ validate_all_nodes() {
 
   local msi_vm_name token_vm_name offline_vm_name kubeadm_vm_name
   local msi_vm_ip token_vm_ip offline_vm_ip kubeadm_vm_ip
-  local token_vm_private_ip offline_vm_private_ip
+  local msi_vm_private_ip token_vm_private_ip offline_vm_private_ip
   msi_vm_name="$(state_get msi_vm_name)"
   token_vm_name="$(state_get token_vm_name)"
   offline_vm_name="$(state_get offline_vm_name)"
   kubeadm_vm_name="$(state_get kubeadm_vm_name)"
   msi_vm_ip="$(state_get msi_vm_ip)"
+  msi_vm_private_ip="$(state_get msi_vm_private_ip)"
   token_vm_ip="$(state_get token_vm_ip)"
   offline_vm_ip="$(state_get offline_vm_ip)"
   kubeadm_vm_ip="$(state_get kubeadm_vm_ip)"
@@ -203,9 +322,18 @@ validate_all_nodes() {
   validate_node_joined "${token_vm_name}" || failed=1
   validate_node_joined "${offline_vm_name}" || failed=1
   validate_node_joined "${kubeadm_vm_name}" || failed=1
+  validate_node_ip "${msi_vm_name}" "${msi_vm_private_ip}" || failed=1
   validate_node_ip "${token_vm_name}" "${token_vm_private_ip}" || failed=1
   validate_node_ip "${offline_vm_name}" "${offline_vm_private_ip}" || failed=1
   validate_npd_status "${msi_vm_name}" "${msi_vm_ip}" || failed=1
+  validate_localdns_status "${msi_vm_name}" "${msi_vm_ip}" || failed=1
+  if [[ "${_E2E_LOCALDNS_REBOOT_VALIDATED}" != "1" ]]; then
+    if validate_localdns_after_reboot "${msi_vm_name}" "${msi_vm_ip}"; then
+      _E2E_LOCALDNS_REBOOT_VALIDATED=1
+    else
+      failed=1
+    fi
+  fi
   validate_npd_status "${token_vm_name}" "${token_vm_ip}" || failed=1
   # TODO: re-enable once NPD is included in the upstream Unbounded bootstrap
   # artifact bundle and resolver used by offline artifact mode.
diff --git a/pkg/config/adapter.go b/pkg/config/adapter.go
index 5ec92755..13de4ad3 100644
--- a/pkg/config/adapter.go
+++ b/pkg/config/adapter.go
@@ -58,6 +58,15 @@ func ToAgentConfig(cfg *Config, machineName string) *agentconfig.AgentConfig {
 		},
 	}
 
+	if profile := cfg.Networking.LocalDNS; profile != nil {
+		corefile, _ := profile.CorefileTemplate() // Config validation runs before adaptation.
+		ac.LocalDNS = &agentconfig.AgentLocalDNSConfig{
+			Enabled:          profile.Enabled(),
+			RequiredPlugins:  []string{"log", "nsid"},
+			CorefileTemplate: corefile,
+		}
+	}
+
 	if provider := cfg.Node.Kubelet.ImageCredentialProvider; provider != nil {
 		ac.Kubelet.ImageCredentialProvider = &agentconfig.ImageCredentialProvider{
 			ConfigPath: provider.ConfigPath,
diff --git a/pkg/config/config.go b/pkg/config/config.go
index 85e7b0ab..e29d2d42 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -267,8 +267,9 @@ type ImageCredentialProviderConfig struct {
 
 // NetworkingConfig is the AKS RP networking contract used by the agent at runtime.
 type NetworkingConfig struct {
-	DNSServiceIP string `json:"dnsServiceIP,omitempty"` // Cluster DNS service IP (default: 10.0.0.10 for AKS)
-	CNIVersion   string `json:"cniVersion,omitempty"`
+	DNSServiceIP string           `json:"dnsServiceIP,omitempty"` // Cluster DNS service IP (default: 10.0.0.10 for AKS)
+	CNIVersion   string           `json:"cniVersion,omitempty"`
+	LocalDNS     *LocalDNSProfile `json:"localDNS,omitempty"`
 }
 
 // NPDConfig holds configuration settings for the Node Problem Detector (NPD).
@@ -897,6 +898,9 @@ func (c *Config) validate() error {
 	if err := c.Node.validate(); err != nil {
 		return err
 	}
+	if err := c.Networking.LocalDNS.Validate(); err != nil {
+		return fmt.Errorf("invalid networking.localDNS: %w", err)
+	}
 
 	if err := c.validateAuthSettings(); err != nil {
 		return err
diff --git a/pkg/config/internal/localdns/assets/localdns.corefile.tmpl b/pkg/config/internal/localdns/assets/localdns.corefile.tmpl
new file mode 100644
index 00000000..c4c54bab
--- /dev/null
+++ b/pkg/config/internal/localdns/assets/localdns.corefile.tmpl
@@ -0,0 +1,38 @@
+# This Corefile follows the AKS AgentBaker LocalDNS policy with adaptations for
+# the Unbounded nspawn runtime:
+# - Node DNS forwards to resolver addresses discovered from the physical host
+#   instead of assuming the Azure platform DNS address.
+# - The metrics endpoint binds a runtime-resolved node address instead of :9253.
+# - The AgentBaker critical-FQDN hosts file is omitted because Unbounded does not
+#   run the AKS hosts-file refresher.
+# - Azure VM suffix guards for internal.cloudapp.net and reddog.microsoft.com
+#   are omitted because Flex Nodes may use non-Azure DNS where those names must
+#   be resolved according to the host's upstream policy.
+# Listener, upstream, cluster DNS, and metrics placeholders are resolved by
+# Unbounded after AKS Flex Node renders the profile-specific server blocks.
+health-check.localdns.local:53 {
+    bind {{.NodeListener}} {{.ClusterListener}}
+    whoami
+}
+
+{{range .Blocks}}{{.Zone}}:53 {
+    {{if .LogQueries}}log{{else}}errors{{end}}
+    bind {{.Listener}}
+    forward . {{.Upstream}} {
+        {{if .ForceTCP}}force_tcp
+        {{end}}policy {{.ForwardPolicy}}
+        max_concurrent {{.MaxConcurrent}}
+    }
+    ready {{.Listener}}:8181
+    cache {{.CacheDuration}} {
+        success 9984
+        denial 9984
+        {{if .ServeStale}}serve_stale {{.ServeStaleDuration}}s {{.ServeStalePolicy}}
+        {{end}}servfail 0
+    }
+    loop
+    nsid {{.NSID}}
+    prometheus {{$.MetricsAddress}}
+}
+
+{{end}}
\ No newline at end of file
diff --git a/pkg/config/internal/localdns/localdns.go b/pkg/config/internal/localdns/localdns.go
new file mode 100644
index 00000000..ce07d9dd
--- /dev/null
+++ b/pkg/config/internal/localdns/localdns.go
@@ -0,0 +1,303 @@
+package localdns
+
+import (
+	"bytes"
+	_ "embed"
+	"errors"
+	"fmt"
+	"sort"
+	"strings"
+	"text/template"
+)
+
+const (
+	LocalDNSModeRequired  = "Required"
+	LocalDNSModePreferred = "Preferred"
+	LocalDNSModeDisabled  = "Disabled"
+)
+
+// LocalDNSProfile mirrors the AKS node-pool LocalDNS configuration contract.
+// Keep rendering behavior aligned with AgentBaker:
+// https://github.com/Azure/AgentBaker/blob/62a783b7a967352bb4726e636d22930c9973f4f7/aks-node-controller/parser/templates/localdns.toml.gtpl
+type LocalDNSProfile struct {
+	Mode             string                      `json:"mode"`
+	VnetDNSOverrides map[string]LocalDNSOverride `json:"vnetDNSOverrides,omitempty"`
+	KubeDNSOverrides map[string]LocalDNSOverride `json:"kubeDNSOverrides,omitempty"`
+}
+
+// LocalDNSOverride configures one CoreDNS server block.
+type LocalDNSOverride struct {
+	QueryLogging                string `json:"queryLogging,omitempty"`
+	Protocol                    string `json:"protocol,omitempty"`
+	ForwardDestination          string `json:"forwardDestination,omitempty"`
+	ForwardPolicy               string `json:"forwardPolicy,omitempty"`
+	MaxConcurrent               int    `json:"maxConcurrent,omitempty"`
+	CacheDurationInSeconds      int    `json:"cacheDurationInSeconds,omitempty"`
+	ServeStaleDurationInSeconds int    `json:"serveStaleDurationInSeconds,omitempty"`
+	ServeStale                  string `json:"serveStale,omitempty"`
+}
+
+// Validate verifies the AKS LocalDNS profile values accepted by the renderer.
+func (p *LocalDNSProfile) Validate() error {
+	if p == nil {
+		return nil
+	}
+	if p.Mode != LocalDNSModeRequired && p.Mode != LocalDNSModePreferred && p.Mode != LocalDNSModeDisabled {
+		return fmt.Errorf("mode must be Required, Preferred, or Disabled")
+	}
+	var errs []error
+	for class, overrides := range map[string]map[string]LocalDNSOverride{
+		"vnetDNSOverrides": p.VnetDNSOverrides,
+		"kubeDNSOverrides": p.KubeDNSOverrides,
+	} {
+		defaultDestination := "VnetDNS"
+		if class == "kubeDNSOverrides" {
+			defaultDestination = "ClusterCoreDNS"
+		}
+		for zone, override := range overrides {
+			if !isValidLocalDNSZone(zone) {
+				errs = append(errs, fmt.Errorf("%s zone %q is invalid", class, zone))
+			}
+			if err := override.validate(); err != nil {
+				errs = append(errs, fmt.Errorf("%s[%q]: %w", class, zone, err))
+			}
+
+			resolved := withLocalDNSDefaults(override, zone, defaultDestination)
+			if class == "vnetDNSOverrides" && zone == "." && resolved.ForwardDestination == "ClusterCoreDNS" {
+				errs = append(errs, fmt.Errorf("%s[%q]: forwardDestination must not be ClusterCoreDNS", class, zone))
+			}
+			if isClusterLocalZone(zone) && resolved.ForwardDestination == "VnetDNS" {
+				errs = append(errs, fmt.Errorf("%s[%q]: forwardDestination must not be VnetDNS", class, zone))
+			}
+			if resolved.Protocol == "ForceTCP" && resolved.ServeStale == "Verify" {
+				errs = append(errs, fmt.Errorf("%s[%q]: serveStale Verify requires protocol PreferUDP", class, zone))
+			}
+		}
+	}
+	return errors.Join(errs...)
+}
+
+func (o LocalDNSOverride) validate() error {
+	var errs []error
+	if o.QueryLogging != "" && o.QueryLogging != "Error" && o.QueryLogging != "Log" {
+		errs = append(errs, fmt.Errorf("queryLogging must be Error or Log"))
+	}
+	if o.Protocol != "" && o.Protocol != "PreferUDP" && o.Protocol != "ForceTCP" {
+		errs = append(errs, fmt.Errorf("protocol must be PreferUDP or ForceTCP"))
+	}
+	if o.ForwardDestination != "" && o.ForwardDestination != "VnetDNS" && o.ForwardDestination != "ClusterCoreDNS" {
+		errs = append(errs, fmt.Errorf("forwardDestination must be VnetDNS or ClusterCoreDNS"))
+	}
+	if o.ForwardPolicy != "" && o.ForwardPolicy != "Sequential" && o.ForwardPolicy != "RoundRobin" && o.ForwardPolicy != "Random" {
+		errs = append(errs, fmt.Errorf("forwardPolicy must be Sequential, RoundRobin, or Random"))
+	}
+	if o.ServeStale != "" && o.ServeStale != "Disable" && o.ServeStale != "Verify" && o.ServeStale != "Immediate" {
+		errs = append(errs, fmt.Errorf("serveStale must be Disable, Verify, or Immediate"))
+	}
+	for name, value := range map[string]int{
+		"maxConcurrent":               o.MaxConcurrent,
+		"cacheDurationInSeconds":      o.CacheDurationInSeconds,
+		"serveStaleDurationInSeconds": o.ServeStaleDurationInSeconds,
+	} {
+		if value < 0 {
+			errs = append(errs, fmt.Errorf("%s must not be negative", name))
+		}
+	}
+	return errors.Join(errs...)
+}
+
+// Enabled reports whether the profile requires LocalDNS installation.
+func (p *LocalDNSProfile) Enabled() bool {
+	return p != nil && p.Mode == LocalDNSModeRequired
+}
+
+//go:embed assets/localdns.corefile.tmpl
+var aksLocalDNSCorefileTemplate string
+
+type localDNSCorefileData struct {
+	NodeListener    string
+	ClusterListener string
+	MetricsAddress  string
+	Blocks          []localDNSCorefileBlock
+}
+
+type localDNSCorefileBlock struct {
+	Zone               string
+	Listener           string
+	Upstream           string
+	NSID               string
+	LogQueries         bool
+	ForceTCP           bool
+	ForwardPolicy      string
+	MaxConcurrent      int
+	CacheDuration      int
+	ServeStale         bool
+	ServeStaleDuration int
+	ServeStalePolicy   string
+}
+
+// CorefileTemplate renders AKS LocalDNS policy into an Unbounded Corefile template.
+func (p *LocalDNSProfile) CorefileTemplate() (string, error) {
+	if p == nil {
+		return "", nil
+	}
+	if err := p.Validate(); err != nil {
+		return "", err
+	}
+	if !p.Enabled() {
+		return "", nil
+	}
+
+	vnet := p.VnetDNSOverrides
+	if len(vnet) == 0 {
+		vnet = defaultLocalDNSOverrides()
+	}
+	kube := p.KubeDNSOverrides
+	if len(kube) == 0 {
+		kube = defaultLocalDNSOverrides()
+	}
+
+	// Rendering happens in two stages. This pass translates the AKS profile into
+	// a Corefile template; Unbounded later resolves these literal placeholders
+	// from machine-specific listener, upstream, cluster DNS, and metrics values.
+	data := localDNSCorefileData{
+		NodeListener:    "{{ .NodeListenerIP }}",
+		ClusterListener: "{{ .ClusterListenerIP }}",
+		MetricsAddress:  "{{ .MetricsAddress }}",
+		Blocks:          append(localDNSCorefileBlocks(vnet, "{{ .NodeListenerIP }}", "VnetDNS"), localDNSCorefileBlocks(kube, "{{ .ClusterListenerIP }}", "ClusterCoreDNS")...),
+	}
+	tmpl, err := template.New("aks-localdns-corefile").Parse(aksLocalDNSCorefileTemplate)
+	if err != nil {
+		return "", fmt.Errorf("parse AKS LocalDNS Corefile template: %w", err)
+	}
+	var out bytes.Buffer
+	if err := tmpl.Execute(&out, data); err != nil {
+		return "", fmt.Errorf("render AKS LocalDNS Corefile template: %w", err)
+	}
+	return out.String(), nil
+}
+
+func localDNSCorefileBlocks(overrides map[string]LocalDNSOverride, listener, defaultDestination string) []localDNSCorefileBlock {
+	zones := make([]string, 0, len(overrides))
+	for zone := range overrides {
+		zones = append(zones, zone)
+	}
+	sort.Strings(zones)
+
+	blocks := make([]localDNSCorefileBlock, 0, len(zones))
+	for _, zone := range zones {
+		o := withLocalDNSDefaults(overrides[zone], zone, defaultDestination)
+		isRootDomain := zone == "."
+		forwardToClusterDNS := o.ForwardDestination == "ClusterCoreDNS" || isClusterLocalZone(zone)
+		// AgentBaker always sends the VnetDNS root zone to the node's DNS path.
+		if defaultDestination == "VnetDNS" && isRootDomain {
+			forwardToClusterDNS = false
+		}
+
+		upstream := "{{ .NodeUpstreamIPsJoined }}"
+		if forwardToClusterDNS {
+			upstream = "{{ .ClusterDNSServiceIP }}"
+		}
+		nsid := "localdns"
+		if defaultDestination == "ClusterCoreDNS" {
+			nsid = "localdns-pod"
+		}
+		blocks = append(blocks, localDNSCorefileBlock{
+			Zone:               zone,
+			Listener:           listener,
+			Upstream:           upstream,
+			NSID:               nsid,
+			LogQueries:         o.QueryLogging == "Log",
+			ForceTCP:           o.Protocol == "ForceTCP",
+			ForwardPolicy:      localDNSForwardPolicy(o.ForwardPolicy),
+			MaxConcurrent:      o.MaxConcurrent,
+			CacheDuration:      o.CacheDurationInSeconds,
+			ServeStale:         o.ServeStale != "Disable",
+			ServeStaleDuration: o.ServeStaleDurationInSeconds,
+			ServeStalePolicy:   strings.ToLower(o.ServeStale),
+		})
+	}
+	return blocks
+}
+
+func isClusterLocalZone(zone string) bool {
+	return strings.HasSuffix(strings.TrimSuffix(zone, "."), "cluster.local")
+}
+
+func isValidLocalDNSZone(zone string) bool {
+	if zone == "." {
+		return true
+	}
+
+	name := strings.TrimSuffix(zone, ".")
+	if name == "" || len(name) > 253 {
+		return false
+	}
+	for _, label := range strings.Split(name, ".") {
+		if len(label) == 0 || len(label) > 63 || !isASCIIAlphaNumeric(label[0]) || !isASCIIAlphaNumeric(label[len(label)-1]) {
+			return false
+		}
+		for i := 1; i < len(label)-1; i++ {
+			if !isASCIIAlphaNumeric(label[i]) && label[i] != '-' {
+				return false
+			}
+		}
+	}
+	return true
+}
+
+func isASCIIAlphaNumeric(value byte) bool {
+	return value >= 'a' && value <= 'z' || value >= 'A' && value <= 'Z' || value >= '0' && value <= '9'
+}
+
+func defaultLocalDNSOverrides() map[string]LocalDNSOverride {
+	return map[string]LocalDNSOverride{
+		".":             {},
+		"cluster.local": {},
+	}
+}
+
+func withLocalDNSDefaults(o LocalDNSOverride, zone, destination string) LocalDNSOverride {
+	if o.QueryLogging == "" {
+		o.QueryLogging = "Error"
+	}
+	if o.Protocol == "" {
+		o.Protocol = "PreferUDP"
+		if isClusterLocalZone(zone) {
+			o.Protocol = "ForceTCP"
+		}
+	}
+	if o.ForwardDestination == "" {
+		o.ForwardDestination = destination
+		if isClusterLocalZone(zone) {
+			o.ForwardDestination = "ClusterCoreDNS"
+		}
+	}
+	if o.ForwardPolicy == "" {
+		o.ForwardPolicy = "Sequential"
+	}
+	if o.MaxConcurrent == 0 {
+		o.MaxConcurrent = 1000
+	}
+	if o.CacheDurationInSeconds == 0 {
+		o.CacheDurationInSeconds = 3600
+	}
+	if o.ServeStaleDurationInSeconds == 0 {
+		o.ServeStaleDurationInSeconds = 3600
+	}
+	if o.ServeStale == "" {
+		o.ServeStale = "Immediate"
+	}
+	return o
+}
+
+func localDNSForwardPolicy(policy string) string {
+	switch policy {
+	case "RoundRobin":
+		return "round_robin"
+	case "Random":
+		return "random"
+	default:
+		return "sequential"
+	}
+}
diff --git a/pkg/config/internal/localdns/localdns_test.go b/pkg/config/internal/localdns/localdns_test.go
new file mode 100644
index 00000000..3aaf81db
--- /dev/null
+++ b/pkg/config/internal/localdns/localdns_test.go
@@ -0,0 +1,112 @@
+package localdns
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestCorefileTemplateGolden(t *testing.T) {
+	t.Parallel()
+
+	profile := &LocalDNSProfile{
+		Mode: LocalDNSModeRequired,
+		VnetDNSOverrides: map[string]LocalDNSOverride{
+			".": {
+				QueryLogging: "Log", Protocol: "PreferUDP", ForwardDestination: "VnetDNS",
+				ForwardPolicy: "Sequential", MaxConcurrent: 1000, CacheDurationInSeconds: 30,
+				ServeStaleDurationInSeconds: 60, ServeStale: "Immediate",
+			},
+			"cluster.local": {
+				QueryLogging: "Error", Protocol: "ForceTCP", ForwardDestination: "ClusterCoreDNS",
+				ForwardPolicy: "RoundRobin", MaxConcurrent: 2000, CacheDurationInSeconds: 45,
+				ServeStale: "Disable",
+			},
+		},
+		KubeDNSOverrides: map[string]LocalDNSOverride{
+			".": {
+				QueryLogging: "Error", Protocol: "PreferUDP", ForwardDestination: "ClusterCoreDNS",
+				ForwardPolicy: "Random", MaxConcurrent: 1500, CacheDurationInSeconds: 90,
+				ServeStaleDurationInSeconds: 120, ServeStale: "Verify",
+			},
+		},
+	}
+
+	got, err := profile.CorefileTemplate()
+	if err != nil {
+		t.Fatalf("CorefileTemplate() error = %v", err)
+	}
+	goldenPath := filepath.Join("testdata", "localdns.corefile.golden")
+	if os.Getenv("UPDATE_GOLDEN") == "1" {
+		if err := os.WriteFile(goldenPath, []byte(got), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	want, err := os.ReadFile(goldenPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != string(want) {
+		t.Fatalf("Corefile mismatch (-want +got):\n--- want ---\n%s\n--- got ---\n%s", want, got)
+	}
+}
+
+func TestLocalDNSDefaultBlocks(t *testing.T) {
+	t.Parallel()
+
+	vnet := localDNSCorefileBlocks(defaultLocalDNSOverrides(), "node-listener", "VnetDNS")
+	kube := localDNSCorefileBlocks(defaultLocalDNSOverrides(), "cluster-listener", "ClusterCoreDNS")
+	if len(vnet) != 2 || len(kube) != 2 {
+		t.Fatalf("default blocks: VnetDNS=%d KubeDNS=%d, want 2 each", len(vnet), len(kube))
+	}
+
+	if vnet[0].Zone != "." || vnet[0].Upstream != "{{ .NodeUpstreamIPsJoined }}" || vnet[0].ForceTCP {
+		t.Errorf("VnetDNS root block = %#v, want node upstream over PreferUDP", vnet[0])
+	}
+	if vnet[1].Zone != "cluster.local" || vnet[1].Upstream != "{{ .ClusterDNSServiceIP }}" || !vnet[1].ForceTCP {
+		t.Errorf("VnetDNS cluster block = %#v, want cluster upstream over ForceTCP", vnet[1])
+	}
+	if kube[0].Zone != "." || kube[0].Upstream != "{{ .ClusterDNSServiceIP }}" || kube[0].ForceTCP {
+		t.Errorf("KubeDNS root block = %#v, want cluster upstream over PreferUDP", kube[0])
+	}
+	if kube[1].Zone != "cluster.local" || kube[1].Upstream != "{{ .ClusterDNSServiceIP }}" || !kube[1].ForceTCP {
+		t.Errorf("KubeDNS cluster block = %#v, want cluster upstream over ForceTCP", kube[1])
+	}
+}
+
+func TestLocalDNSCorefileBlocksAgentBakerRouting(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name               string
+		zone               string
+		destination        string
+		defaultDestination string
+		wantUpstream       string
+		wantNSID           string
+	}{
+		{name: "VnetDNS root stays on node DNS", zone: ".", destination: "ClusterCoreDNS", defaultDestination: "VnetDNS", wantUpstream: "{{ .NodeUpstreamIPsJoined }}", wantNSID: "localdns"},
+		{name: "VnetDNS cluster suffix uses cluster DNS", zone: "svc.cluster.local", destination: "VnetDNS", defaultDestination: "VnetDNS", wantUpstream: "{{ .ClusterDNSServiceIP }}", wantNSID: "localdns"},
+		{name: "KubeDNS cluster suffix uses cluster DNS", zone: "svc.cluster.local", destination: "VnetDNS", defaultDestination: "ClusterCoreDNS", wantUpstream: "{{ .ClusterDNSServiceIP }}", wantNSID: "localdns-pod"},
+		{name: "KubeDNS custom zone honors VnetDNS", zone: "example.com", destination: "VnetDNS", defaultDestination: "ClusterCoreDNS", wantUpstream: "{{ .NodeUpstreamIPsJoined }}", wantNSID: "localdns-pod"},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			blocks := localDNSCorefileBlocks(map[string]LocalDNSOverride{
+				test.zone: {ForwardDestination: test.destination},
+			}, "listener", test.defaultDestination)
+			if len(blocks) != 1 {
+				t.Fatalf("localDNSCorefileBlocks() returned %d blocks, want 1", len(blocks))
+			}
+			if blocks[0].Upstream != test.wantUpstream {
+				t.Errorf("Upstream = %q, want %q", blocks[0].Upstream, test.wantUpstream)
+			}
+			if blocks[0].NSID != test.wantNSID {
+				t.Errorf("NSID = %q, want %q", blocks[0].NSID, test.wantNSID)
+			}
+		})
+	}
+}
diff --git a/pkg/config/internal/localdns/testdata/localdns.corefile.golden b/pkg/config/internal/localdns/testdata/localdns.corefile.golden
new file mode 100644
index 00000000..519896be
--- /dev/null
+++ b/pkg/config/internal/localdns/testdata/localdns.corefile.golden
@@ -0,0 +1,74 @@
+# This Corefile follows the AKS AgentBaker LocalDNS policy with adaptations for
+# the Unbounded nspawn runtime:
+# - Node DNS forwards to resolver addresses discovered from the physical host
+#   instead of assuming the Azure platform DNS address.
+# - The metrics endpoint binds a runtime-resolved node address instead of :9253.
+# - The AgentBaker critical-FQDN hosts file is omitted because Unbounded does not
+#   run the AKS hosts-file refresher.
+# - Azure VM suffix guards for internal.cloudapp.net and reddog.microsoft.com
+#   are omitted because Flex Nodes may use non-Azure DNS where those names must
+#   be resolved according to the host's upstream policy.
+# Listener, upstream, cluster DNS, and metrics placeholders are resolved by
+# Unbounded after AKS Flex Node renders the profile-specific server blocks.
+health-check.localdns.local:53 {
+    bind {{ .NodeListenerIP }} {{ .ClusterListenerIP }}
+    whoami
+}
+
+.:53 {
+    log
+    bind {{ .NodeListenerIP }}
+    forward . {{ .NodeUpstreamIPsJoined }} {
+        policy sequential
+        max_concurrent 1000
+    }
+    ready {{ .NodeListenerIP }}:8181
+    cache 30 {
+        success 9984
+        denial 9984
+        serve_stale 60s immediate
+        servfail 0
+    }
+    loop
+    nsid localdns
+    prometheus {{ .MetricsAddress }}
+}
+
+cluster.local:53 {
+    errors
+    bind {{ .NodeListenerIP }}
+    forward . {{ .ClusterDNSServiceIP }} {
+        force_tcp
+        policy round_robin
+        max_concurrent 2000
+    }
+    ready {{ .NodeListenerIP }}:8181
+    cache 45 {
+        success 9984
+        denial 9984
+        servfail 0
+    }
+    loop
+    nsid localdns
+    prometheus {{ .MetricsAddress }}
+}
+
+.:53 {
+    errors
+    bind {{ .ClusterListenerIP }}
+    forward . {{ .ClusterDNSServiceIP }} {
+        policy random
+        max_concurrent 1500
+    }
+    ready {{ .ClusterListenerIP }}:8181
+    cache 90 {
+        success 9984
+        denial 9984
+        serve_stale 120s verify
+        servfail 0
+    }
+    loop
+    nsid localdns-pod
+    prometheus {{ .MetricsAddress }}
+}
+
diff --git a/pkg/config/localdns.go b/pkg/config/localdns.go
new file mode 100644
index 00000000..0422fbfe
--- /dev/null
+++ b/pkg/config/localdns.go
@@ -0,0 +1,15 @@
+package config
+
+import "github.com/Azure/AKSFlexNode/pkg/config/internal/localdns"
+
+const (
+	LocalDNSModeRequired  = localdns.LocalDNSModeRequired
+	LocalDNSModePreferred = localdns.LocalDNSModePreferred
+	LocalDNSModeDisabled  = localdns.LocalDNSModeDisabled
+)
+
+// LocalDNSProfile is the AKS node-pool LocalDNS configuration contract.
+type LocalDNSProfile = localdns.LocalDNSProfile
+
+// LocalDNSOverride configures one AKS LocalDNS server block.
+type LocalDNSOverride = localdns.LocalDNSOverride
diff --git a/pkg/config/localdns_adapter_test.go b/pkg/config/localdns_adapter_test.go
new file mode 100644
index 00000000..0afdea10
--- /dev/null
+++ b/pkg/config/localdns_adapter_test.go
@@ -0,0 +1,52 @@
+package config
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestToAgentConfigLocalDNS(t *testing.T) {
+	t.Parallel()
+
+	cfg := &Config{
+		Networking: NetworkingConfig{
+			DNSServiceIP: "10.0.0.10",
+			LocalDNS: &LocalDNSProfile{
+				Mode: LocalDNSModeRequired,
+				KubeDNSOverrides: map[string]LocalDNSOverride{
+					".": {ForwardDestination: "ClusterCoreDNS"},
+				},
+			},
+		},
+		Node: NodeConfig{Labels: map[string]string{"example": "value"}},
+	}
+
+	got := ToAgentConfig(cfg, "kube1")
+	if got.LocalDNS == nil || !got.LocalDNS.Enabled {
+		t.Fatalf("LocalDNS = %#v, want enabled", got.LocalDNS)
+	}
+	if !strings.Contains(got.LocalDNS.CorefileTemplate, "{{ .ClusterDNSServiceIP }}") {
+		t.Fatalf("CorefileTemplate missing cluster DNS placeholder:\n%s", got.LocalDNS.CorefileTemplate)
+	}
+	for _, plugin := range []string{"log", "nsid"} {
+		if !strings.Contains(strings.Join(got.LocalDNS.RequiredPlugins, ","), plugin) {
+			t.Errorf("RequiredPlugins = %v, want %q", got.LocalDNS.RequiredPlugins, plugin)
+		}
+	}
+	if got.Cluster.ClusterDNS != "10.0.0.10" {
+		t.Fatalf("ClusterDNS = %q, want original service IP", got.Cluster.ClusterDNS)
+	}
+}
+
+func TestToAgentConfigDisabledLocalDNS(t *testing.T) {
+	t.Parallel()
+
+	cfg := &Config{Networking: NetworkingConfig{
+		DNSServiceIP: "10.0.0.10",
+		LocalDNS:     &LocalDNSProfile{Mode: LocalDNSModeDisabled},
+	}}
+	got := ToAgentConfig(cfg, "kube1")
+	if got.LocalDNS == nil || got.LocalDNS.Enabled {
+		t.Fatalf("LocalDNS = %#v, want explicitly disabled", got.LocalDNS)
+	}
+}
diff --git a/pkg/config/localdns_test.go b/pkg/config/localdns_test.go
new file mode 100644
index 00000000..a019dbf3
--- /dev/null
+++ b/pkg/config/localdns_test.go
@@ -0,0 +1,177 @@
+package config
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestLocalDNSProfileCorefileTemplate(t *testing.T) {
+	t.Parallel()
+
+	profile := &LocalDNSProfile{
+		Mode: LocalDNSModeRequired,
+		VnetDNSOverrides: map[string]LocalDNSOverride{
+			".": {ForwardDestination: "VnetDNS", Protocol: "PreferUDP"},
+		},
+		KubeDNSOverrides: map[string]LocalDNSOverride{
+			".": {ForwardDestination: "ClusterCoreDNS", Protocol: "ForceTCP", ForwardPolicy: "RoundRobin"},
+		},
+	}
+	got, err := profile.CorefileTemplate()
+	if err != nil {
+		t.Fatalf("CorefileTemplate() error = %v", err)
+	}
+	for _, want := range []string{
+		"bind {{ .NodeListenerIP }}",
+		"forward . {{ .NodeUpstreamIPsJoined }}",
+		"bind {{ .ClusterListenerIP }}",
+		"forward . {{ .ClusterDNSServiceIP }}",
+		"force_tcp",
+		"policy round_robin",
+	} {
+		if !strings.Contains(got, want) {
+			t.Fatalf("CorefileTemplate() missing %q:\n%s", want, got)
+		}
+	}
+}
+
+func TestLocalDNSProfileDefaultCorefile(t *testing.T) {
+	t.Parallel()
+
+	got, err := (&LocalDNSProfile{Mode: LocalDNSModeRequired}).CorefileTemplate()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if roots, clusters := strings.Count(got, "\n.:53 {"), strings.Count(got, "\ncluster.local:53 {"); roots != 2 || clusters != 2 {
+		t.Fatalf("Corefile default blocks: root=%d cluster.local=%d, want 2 each:\n%s", roots, clusters, got)
+	}
+	for _, want := range []string{
+		".:53 {\n    errors\n    bind {{ .NodeListenerIP }}\n    forward . {{ .NodeUpstreamIPsJoined }}",
+		"cluster.local:53 {\n    errors\n    bind {{ .NodeListenerIP }}\n    forward . {{ .ClusterDNSServiceIP }}",
+		".:53 {\n    errors\n    bind {{ .ClusterListenerIP }}\n    forward . {{ .ClusterDNSServiceIP }}",
+		"cluster.local:53 {\n    errors\n    bind {{ .ClusterListenerIP }}\n    forward . {{ .ClusterDNSServiceIP }}",
+	} {
+		if !strings.Contains(got, want) {
+			t.Errorf("default Corefile missing %q:\n%s", want, got)
+		}
+	}
+}
+
+func TestLocalDNSProfileCorefileOptions(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name       string
+		override   LocalDNSOverride
+		want       []string
+		wantAbsent []string
+	}{
+		{
+			name:       "VnetDNS PreferUDP sequential immediate",
+			override:   LocalDNSOverride{QueryLogging: "Log", Protocol: "PreferUDP", ForwardDestination: "VnetDNS", ForwardPolicy: "Sequential", MaxConcurrent: 1000, CacheDurationInSeconds: 30, ServeStaleDurationInSeconds: 60, ServeStale: "Immediate"},
+			want:       []string{"log", "forward . {{ .NodeUpstreamIPsJoined }}", "policy sequential", "max_concurrent 1000", "cache 30", "serve_stale 60s immediate"},
+			wantAbsent: []string{"force_tcp"},
+		},
+		{
+			name:     "ClusterCoreDNS ForceTCP round robin immediate",
+			override: LocalDNSOverride{QueryLogging: "Error", Protocol: "ForceTCP", ForwardDestination: "ClusterCoreDNS", ForwardPolicy: "RoundRobin", ServeStale: "Immediate"},
+			want:     []string{"errors", "forward . {{ .ClusterDNSServiceIP }}", "force_tcp", "policy round_robin", "serve_stale 3600s immediate"},
+		},
+		{
+			name:       "random without stale",
+			override:   LocalDNSOverride{ForwardDestination: "ClusterCoreDNS", ForwardPolicy: "Random", ServeStale: "Disable"},
+			want:       []string{"policy random"},
+			wantAbsent: []string{"serve_stale"},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+			vnetOverride := test.override
+			vnetOverride.ForwardDestination = "VnetDNS"
+			kubeOverride := test.override
+			kubeOverride.ForwardDestination = "ClusterCoreDNS"
+			profile := &LocalDNSProfile{
+				Mode:             LocalDNSModeRequired,
+				VnetDNSOverrides: map[string]LocalDNSOverride{".": vnetOverride},
+				KubeDNSOverrides: map[string]LocalDNSOverride{".": kubeOverride},
+			}
+			got, err := profile.CorefileTemplate()
+			if err != nil {
+				t.Fatalf("CorefileTemplate() error = %v", err)
+			}
+			for _, want := range test.want {
+				if !strings.Contains(got, want) {
+					t.Errorf("CorefileTemplate() missing %q:\n%s", want, got)
+				}
+			}
+			for _, unwanted := range test.wantAbsent {
+				if strings.Contains(got, unwanted) {
+					t.Errorf("CorefileTemplate() unexpectedly contains %q:\n%s", unwanted, got)
+				}
+			}
+		})
+	}
+}
+
+func TestLocalDNSProfileCorefileZoneOrder(t *testing.T) {
+	t.Parallel()
+
+	profile := &LocalDNSProfile{Mode: LocalDNSModeRequired, VnetDNSOverrides: map[string]LocalDNSOverride{
+		"z.example": {},
+		".":         {},
+		"a.example": {},
+	}}
+	got, err := profile.CorefileTemplate()
+	if err != nil {
+		t.Fatal(err)
+	}
+	root := strings.Index(got, ".:53 {")
+	a := strings.Index(got, "a.example:53 {")
+	z := strings.Index(got, "z.example:53 {")
+	if root < 0 || a < root || z < a {
+		t.Fatalf("zones are not deterministic: root=%d a=%d z=%d\n%s", root, a, z, got)
+	}
+}
+
+func TestLocalDNSProfileValidation(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		profile *LocalDNSProfile
+		wantErr string
+	}{
+		{name: "required", profile: &LocalDNSProfile{Mode: LocalDNSModeRequired}},
+		{name: "preferred", profile: &LocalDNSProfile{Mode: LocalDNSModePreferred}},
+		{name: "disabled", profile: &LocalDNSProfile{Mode: LocalDNSModeDisabled}},
+		{name: "invalid mode", profile: &LocalDNSProfile{Mode: "On"}, wantErr: "mode"},
+		{name: "invalid comment zone", profile: &LocalDNSProfile{Mode: LocalDNSModeRequired, VnetDNSOverrides: map[string]LocalDNSOverride{"#": {}}}, wantErr: "zone"},
+		{name: "invalid underscore zone", profile: &LocalDNSProfile{Mode: LocalDNSModeRequired, VnetDNSOverrides: map[string]LocalDNSOverride{"bad_zone.example": {}}}, wantErr: "zone"},
+		{name: "valid absolute zone", profile: &LocalDNSProfile{Mode: LocalDNSModeRequired, VnetDNSOverrides: map[string]LocalDNSOverride{"example.com.": {}}}},
+		{name: "invalid protocol", profile: &LocalDNSProfile{Mode: LocalDNSModeRequired, VnetDNSOverrides: map[string]LocalDNSOverride{".": {Protocol: "TLS"}}}, wantErr: "protocol"},
+		{name: "invalid logging", profile: &LocalDNSProfile{Mode: LocalDNSModeRequired, VnetDNSOverrides: map[string]LocalDNSOverride{".": {QueryLogging: "Debug"}}}, wantErr: "queryLogging"},
+		{name: "invalid destination", profile: &LocalDNSProfile{Mode: LocalDNSModeRequired, VnetDNSOverrides: map[string]LocalDNSOverride{".": {ForwardDestination: "External"}}}, wantErr: "forwardDestination"},
+		{name: "invalid policy", profile: &LocalDNSProfile{Mode: LocalDNSModeRequired, VnetDNSOverrides: map[string]LocalDNSOverride{".": {ForwardPolicy: "First"}}}, wantErr: "forwardPolicy"},
+		{name: "invalid stale", profile: &LocalDNSProfile{Mode: LocalDNSModeRequired, VnetDNSOverrides: map[string]LocalDNSOverride{".": {ServeStale: "Always"}}}, wantErr: "serveStale"},
+		{name: "negative cache", profile: &LocalDNSProfile{Mode: LocalDNSModeRequired, VnetDNSOverrides: map[string]LocalDNSOverride{".": {CacheDurationInSeconds: -1}}}, wantErr: "cacheDurationInSeconds"},
+		{name: "VnetDNS root to cluster DNS", profile: &LocalDNSProfile{Mode: LocalDNSModeRequired, VnetDNSOverrides: map[string]LocalDNSOverride{".": {ForwardDestination: "ClusterCoreDNS"}}}, wantErr: "must not be ClusterCoreDNS"},
+		{name: "cluster zone to VnetDNS", profile: &LocalDNSProfile{Mode: LocalDNSModeRequired, KubeDNSOverrides: map[string]LocalDNSOverride{"cluster.local": {ForwardDestination: "VnetDNS"}}}, wantErr: "must not be VnetDNS"},
+		{name: "ForceTCP with stale verification", profile: &LocalDNSProfile{Mode: LocalDNSModeRequired, KubeDNSOverrides: map[string]LocalDNSOverride{".": {Protocol: "ForceTCP", ServeStale: "Verify"}}}, wantErr: "requires protocol PreferUDP"},
+		{name: "cluster default protocol with stale verification", profile: &LocalDNSProfile{Mode: LocalDNSModeRequired, KubeDNSOverrides: map[string]LocalDNSOverride{"cluster.local": {ServeStale: "Verify"}}}, wantErr: "requires protocol PreferUDP"},
+		{name: "root default protocol with stale verification", profile: &LocalDNSProfile{Mode: LocalDNSModeRequired, KubeDNSOverrides: map[string]LocalDNSOverride{".": {ServeStale: "Verify"}}}},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+			err := test.profile.Validate()
+			if test.wantErr == "" && err != nil {
+				t.Fatalf("validate() error = %v", err)
+			}
+			if test.wantErr != "" && (err == nil || !strings.Contains(err.Error(), test.wantErr)) {
+				t.Fatalf("validate() error = %v, want %q", err, test.wantErr)
+			}
+		})
+	}
+}