diff --git a/README.rst b/README.rst
index 8e3f7df..bebe7d7 100644
--- a/README.rst
+++ b/README.rst
@@ -1105,6 +1105,44 @@
                     virtual_network: 'virtual-network'
 
 
+Contrail DNS custom forwarders
+------------------------------
+
+By default Contrail uses the /etc/resolv.conf file to determine the upstream DNS servers.
+This can have some side-affects, like resolving internal DNS entries on you public instances.
+
+In order to overrule this default set, you can configure nameservers using pillar data.
+The formula is then responsible for configuring and generating a alternate resolv.conf file.
+
+Note: this has been patched recently in the Contrail distribution of Mirantis:
+https://github.com/Mirantis/contrail-controller/commit/ed9a25ccbcfebd7d079a93aecc5a1a7bf1265ea4
+https://github.com/Mirantis/contrail-controller/commit/94c844cf2e9bcfcd48587aec03d10b869e737ade
+
+
+To change forwarders for the default-dns option (which is handled by compute nodes):
+
+.. code-block:: yaml
+
+    compute:
+      ....
+      dns:
+        forwarders:
+        - 8.8.8.8
+        - 8.8.4.4
+      ....
+
+To change forwarders for vDNS zones (handled by control nodes):
+
+.. code-block:: yaml
+
+    control:
+      ....
+      dns:
+        forwarders:
+        - 8.8.8.8
+        - 8.8.4.4
+      ....
+
 
 Usage
 =====
diff --git a/opencontrail/common.sls b/opencontrail/common.sls
index 020bc0e..b3ae6a7 100644
--- a/opencontrail/common.sls
+++ b/opencontrail/common.sls
@@ -122,4 +122,5 @@
   - require:
     - file: /etc/contrail
 {%- endif %}
+
 {%- endif %}
diff --git a/opencontrail/compute.sls b/opencontrail/compute.sls
index c047a5a..8462c7f 100644
--- a/opencontrail/compute.sls
+++ b/opencontrail/compute.sls
@@ -59,6 +59,18 @@
   - require:
     - pkg: opencontrail_compute_packages
 
+{%- if compute.version == 3.0 and compute.get('dns', {}).get('forwarders', False) %}
+contrail_compute_resolv:
+  file.managed:
+  - name: /etc/contrail/resolv.conf
+  - source: salt://opencontrail/files/{{ compute.version }}/resolv.conf
+  - template: jinja
+  - defaults:
+      dns: {{ compute.get('dns', {})|yaml }}
+  - require:
+    - file: /etc/contrail
+{%- endif %}
+
 {%- endif %}
 
 /etc/contrail/agent_param:
diff --git a/opencontrail/control.sls b/opencontrail/control.sls
index d3a8bdb..ea00f9b 100644
--- a/opencontrail/control.sls
+++ b/opencontrail/control.sls
@@ -64,6 +64,18 @@
   - source: salt://opencontrail/files/{{ control.version }}/control/contrail-rndc.conf
   - makedirs: True
 
+{%- if control.version == 3.0 and control.get('dns', {}).get('forwarders', False) %}
+contrail_control_resolv:
+  file.managed:
+  - name: /etc/contrail/resolv.conf
+  - source: salt://opencontrail/files/{{ control.version }}/resolv.conf
+  - template: jinja
+  - defaults:
+      dns: {{ control.get('dns', {})|yaml }}
+  - require:
+    - file: /etc/contrail
+{%- endif %}
+
 {%- if control.version >= 3.0 and grains.get('init') != 'systemd' %}
 
 /etc/contrail/supervisord_control_files/contrail-control-nodemgr.ini:
diff --git a/opencontrail/files/3.0/contrail-dns.conf b/opencontrail/files/3.0/contrail-dns.conf
index 88676bd..256cdbe 100644
--- a/opencontrail/files/3.0/contrail-dns.conf
+++ b/opencontrail/files/3.0/contrail-dns.conf
@@ -13,6 +13,12 @@
 # named_log_file=/var/log/contrail/contrail-named.log   # named log file
 # rndc_config_file=contrail-rndc.conf                   # rndc config file
 # rndc_secret=secretkey                                 # rndc secret
+# resolv_conf_file=                                     # Absolute path to file containing nameservers list
+{%- if control.get('dns', {}).get('forwarders', False) %}
+resolv_conf_file=/etc/contrail/resolv.conf
+{%- endif %}
+# /etc/resolv.conf is used as default if none specified.
+
   hostip={{ control.bind.address }} # Resolved IP of `hostname`
   {%- if control.name is defined %}
   hostname={{ control.name }}
diff --git a/opencontrail/files/3.0/contrail-vrouter-agent.conf b/opencontrail/files/3.0/contrail-vrouter-agent.conf
index 16bd5d9..6522e53 100644
--- a/opencontrail/files/3.0/contrail-vrouter-agent.conf
+++ b/opencontrail/files/3.0/contrail-vrouter-agent.conf
@@ -104,6 +104,22 @@
 # the value provided by discovery service will be used.
 # server=10.0.0.1:53 10.0.0.2:53
 
+# Client port used by vrouter-agent while connecting to contrail-named
+# dns_client_port=
+
+# Timeout for DNS server queries in milli-seconds
+# dns_timeout=
+
+# Maximum retries for DNS server queries
+# dns_max_retries=
+
+# Absolute path for custom nameserver file for default-dns method
+# If none specified, /etc/resolv.conf will be used instead
+# resolv_conf_file =
+{%- if compute.get('dns', {}).get('forwarders', False) %}
+resolv_conf_file=/etc/contrail/resolv.conf
+{%- endif %}
+
 [HYPERVISOR]
 # Everything in this section is optional
 
diff --git a/opencontrail/files/3.0/resolv.conf b/opencontrail/files/3.0/resolv.conf
new file mode 100644
index 0000000..36e2222
--- /dev/null
+++ b/opencontrail/files/3.0/resolv.conf
@@ -0,0 +1,4 @@
+
+{%- for host in dns.get('forwarders', []) %}
+nameserver {{ host }}
+{%- endfor %}
diff --git a/tests/pillar/cluster3.sls b/tests/pillar/cluster3.sls
index 0da7506..1f97957 100644
--- a/tests/pillar/cluster3.sls
+++ b/tests/pillar/cluster3.sls
@@ -68,6 +68,10 @@
     name: ntw-01
     bind:
       address: 127.0.0.1
+    dns:
+      forwarders:
+      - 8.8.8.8
+      - 8.8.4.4
     discovery:
       host: 127.0.0.1
     master:
diff --git a/tests/pillar/control3.sls b/tests/pillar/control3.sls
index 1800c00..4c580df 100644
--- a/tests/pillar/control3.sls
+++ b/tests/pillar/control3.sls
@@ -70,6 +70,10 @@
     name: ntw-01
     bind:
       address: 127.0.0.1
+    dns:
+      forwarders:
+      - 8.8.8.8
+      - 8.8.4.4
     discovery:
       host: 127.0.0.1
     master:
diff --git a/tests/pillar/vrouter3.sls b/tests/pillar/vrouter3.sls
index d9ba886..807b510 100644
--- a/tests/pillar/vrouter3.sls
+++ b/tests/pillar/vrouter3.sls
@@ -18,6 +18,10 @@
       host: 127.0.0.1
     bind:
       address: 127.0.0.1
+    dns:
+      forwarders:
+      - 8.8.8.8
+      - 8.8.4.4
     interface:
       address: 127.0.0.1
       dev: eth0