diff --git a/envoy/api/v2/cds.proto b/envoy/api/v2/cds.proto
index c462ba64..677d6283 100644
--- a/envoy/api/v2/cds.proto
+++ b/envoy/api/v2/cds.proto
@@ -47,7 +47,7 @@ service ClusterDiscoveryService {
 }
 
 // Configuration for a single upstream cluster.
-// [#next-free-field: 45]
+// [#next-free-field: 46]
 message Cluster {
   // Refer to :ref:`service discovery type <arch_overview_service_discovery_types>`
   // for an explanation on each type.
@@ -683,6 +683,10 @@ message Cluster {
   // this setting is ignored.
   repeated core.Address dns_resolvers = 18;
 
+  // [#next-major-version: Reconcile DNS options in a single message.]
+  // Always use TCP queries instead of UDP queries for DNS lookups.
+  bool use_tcp_for_dns_lookups = 45;
+
   // If specified, outlier detection will be enabled for this upstream cluster.
   // Each of the configuration values can be overridden via
   // :ref:`runtime values <config_cluster_manager_cluster_runtime_outlier_detection>`.
diff --git a/envoy/api/v3alpha/cds.proto b/envoy/api/v3alpha/cds.proto
index 1e9f7eca..80004af9 100644
--- a/envoy/api/v3alpha/cds.proto
+++ b/envoy/api/v3alpha/cds.proto
@@ -48,7 +48,7 @@ service ClusterDiscoveryService {
 }
 
 // Configuration for a single upstream cluster.
-// [#next-free-field: 45]
+// [#next-free-field: 46]
 message Cluster {
   option (udpa.api.annotations.versioning).previous_message_type = "envoy.api.v2.Cluster";
 
@@ -706,6 +706,10 @@ message Cluster {
   // this setting is ignored.
   repeated core.Address dns_resolvers = 18;
 
+  // [#next-major-version: Reconcile DNS options in a single message.]
+  // Always use TCP queries instead of UDP queries for DNS lookups.
+  bool use_tcp_for_dns_lookups = 45;
+
   // If specified, outlier detection will be enabled for this upstream cluster.
   // Each of the configuration values can be overridden via
   // :ref:`runtime values <config_cluster_manager_cluster_runtime_outlier_detection>`.
diff --git a/envoy/config/bootstrap/v2/bootstrap.proto b/envoy/config/bootstrap/v2/bootstrap.proto
index 0f8d6013..9615168d 100644
--- a/envoy/config/bootstrap/v2/bootstrap.proto
+++ b/envoy/config/bootstrap/v2/bootstrap.proto
@@ -28,7 +28,7 @@ import "validate/validate.proto";
 // <config_overview_v2_bootstrap>` for more detail.
 
 // Bootstrap :ref:`configuration overview <config_overview_v2_bootstrap>`.
-// [#next-free-field: 20]
+// [#next-free-field: 21]
 message Bootstrap {
   message StaticResources {
     // Static :ref:`Listeners <envoy_api_msg_Listener>`. These listeners are
@@ -155,6 +155,13 @@ message Bootstrap {
   // <server_statistics>` if specified. Envoy will not process this value, it will be sent as is to
   // :ref:`stats sinks <envoy_api_msg_config.metrics.v2.StatsSink>`.
   google.protobuf.UInt64Value stats_server_version_override = 19;
+
+  // Always use TCP queries instead of UDP queries for DNS lookups.
+  // This may be overridden on a per-cluster basis in cds_config,
+  // when :ref:`dns_resolvers <envoy_api_field_Cluster.dns_resolvers>` and
+  // :ref:`use_tcp_for_dns_lookups <envoy_api_field_Cluster.use_tcp_for_dns_lookups>` are
+  // specified.
+  bool use_tcp_for_dns_lookups = 20;
 }
 
 // Administration interface :ref:`operations documentation
diff --git a/envoy/config/bootstrap/v3alpha/bootstrap.proto b/envoy/config/bootstrap/v3alpha/bootstrap.proto
index 9f336bb8..b6a16554 100644
--- a/envoy/config/bootstrap/v3alpha/bootstrap.proto
+++ b/envoy/config/bootstrap/v3alpha/bootstrap.proto
@@ -30,7 +30,7 @@ import "validate/validate.proto";
 // <config_overview_v2_bootstrap>` for more detail.
 
 // Bootstrap :ref:`configuration overview <config_overview_v2_bootstrap>`.
-// [#next-free-field: 20]
+// [#next-free-field: 21]
 message Bootstrap {
   option (udpa.api.annotations.versioning).previous_message_type =
       "envoy.config.bootstrap.v2.Bootstrap";
@@ -162,6 +162,13 @@ message Bootstrap {
   // <server_statistics>` if specified. Envoy will not process this value, it will be sent as is to
   // :ref:`stats sinks <envoy_api_msg_config.metrics.v3alpha.StatsSink>`.
   google.protobuf.UInt64Value stats_server_version_override = 19;
+
+  // Always use TCP queries instead of UDP queries for DNS lookups.
+  // This may be overridden on a per-cluster basis in cds_config,
+  // when :ref:`dns_resolvers <envoy_api_field_api.v3alpha.Cluster.dns_resolvers>` and
+  // :ref:`use_tcp_for_dns_lookups <envoy_api_field_api.v3alpha.Cluster.use_tcp_for_dns_lookups>`
+  // are specified.
+  bool use_tcp_for_dns_lookups = 20;
 }
 
 // Administration interface :ref:`operations documentation