In OSSM 3.x we dropped the configuration in the Pilot reading 

spec:
  values:
    global:
      ...
    meshConfig:
      defaultConfig:
        proxyMetadata:
          ISTIO_META_DNS_CAPTURE: "true" 

which was default in 2.x to ensure ServiceEntries are resolve-able.

Adding this configuration fails OCP-V VM's to resolve anything, most likely due to a missing nft rule for DNS capturing ? 

I've put a KCS in place how to mitigate that situation but we need a solution as patching n^ VM's is most likely not warm welcomed by Customers.

https://access.redhat.com/solutions/7132293