This release improves DNS caching, forwarding, and transport reliability, with fixes for stale-cache handling, upstream connections, crashes/race fixes, as well as enhancemence from quite a few plugins. Forwarding now supports DNS-over-QUIC upstreams. Additional new features include optional JSON query logging, authenticated RFC 2136 dynamic DNS updates, SIIT support, expr-lang templates, and PROX…
This release strengthens DNS caching, forwarding, and transport reliability, with improved stale-cache behavior, safer upstream handling, and tighter connection and overload controls. It also adds new capabilities for ACME-managed TLS, topology-aware Kubernetes services, HTTP/2 forwarding, DNS-over-QUIC, and secondary zone management, while delivering correctness and performance fixes across file…
This patch release focuses on fixing ARM and MIPS build issues introduced in v1.14.5 by downgrading the dd-trace-go dependency, while also including improvements to forwarding and secondary zone support. Brought to You By Filippo125 houyuwushang Immanuel Tikhonov Ville Vesilehto Yong Tang Noteworthy Changes core: Downgrade dd-trace-go to v2.8.2 (#8266) plugin/auto: Keep first matching zone file fo…
This release improves DNS transport security and operational reliability, with safer DoH/DoH3 handling, enhanced forwarding configuration, and improved dnstap support. It also adds robustness improvements across file serving, secondary zones, transfers, rewrites, hosts handling, and error processing, while fixing several edge cases in DNS response handling. Brought to You By Aaron Mark Amirhossein…
This release improves transport security and operational flexibility, with enhancements for DoH3 and DoQ, improved DNSSEC signing behavior, and support for the loong64 architecture. It also adds configurable cache verification, hostname resolution for forward targets, incoming connection support for dnstap, fallthrough support in the secondary plugin, automatic zone reloads, and improved forwardin…
This release introduces Windows service support, along with full TSIG verification across DoH, DoH3, QUIC, and gRPC transports, and improved TSIG propagation and DoH request validation. It also adds optional TLS for the metrics endpoint. Performance and stability are improved through cache prefetching, QUIC optimizations, and a new max_age option in the forward plugin. Additional updates include e…
This release adds the new proxyproto plugin to support Proxy Protocol and preserve client IPs behind load balancers. It also includes enhancements such as improved DNS logging metadata and stronger randomness for loop detection (CVE-2026-26018), along with several bug fixes including TLS+IPv6 forwarding, improved CNAME handling and rewriting, allowing jitter disabling, prevention of an ACL bypass…
This release primarily addresses security vulnerabilities affecting Go versions prior to Go 1.25.6 and Go 1.24.12 (CVE-2025-61728, CVE-2025-61726, CVE-2025-68121, CVE-2025-61731, CVE-2025-68119). It also includes performance improvements to the proxy plugin via multiplexed connections, along with various documentation updates. Brought to You By Alex Massy Shiv Tyagi Ville Vesilehto Yong Tang Notew…
This release focuses on security hardening and operational reliability. Core updates introduce a regex length limit to reduce resource-exhaustion risk. Plugin updates improve error consolidation (show_first), reduce misleading SOA warnings, add Kubernetes API rate limiting, enhance metrics with plugin chain tracking, and fix issues in azure and sign. This release also includes additional security…
This release adds initial support for DoH3 and includes several core performance and stability fixes, including reduced allocations, a resolved data race in uniq, and safer QUIC listener initialization. Plugin updates improve forwarder reliability, extend GeoIP schema support, and fix issues in secondary, nomad, and kubernetes. Cache and file plugins also receive targeted performance tuning. Depre…
This release updates CoreDNS to Go 1.25.2 and golang.org/x/net v0.45.0 to address multiple high-severity CVEs. It also improves core performance by avoiding string concatenation in loops, and hardens the sign plugin by rejecting invalid UTF-8 tokens in dbfile. Brought to You By Catena cyber Ville Vesilehto Yong Tang Noteworthy Changes core: Avoid string concatenation in loops (#7572) core: Update…
This release introduces a new Nomad plugin for integrating CoreDNS with HashiCorp Nomad. It also fixes major Corefile issues on infinite loops and import cycles, improves shutdown handling, normalizes core panics, addresses data races in the file plugin, enforces gRPC size limits, adjusts forward failover behavior, as well as prevents reload deadlocks. Brought to You By Fitz_dev Ilya Kulakov Olli…
This release improves stability and security, fixing context propagation in DoH, label offset handling in the file plugin, and connection leaks in gRPC and transfer. It also adds support for the prefer option in loadbalance, introduces timeouts to the metrics server, and fixes several security vulnerabilities (see details in related security advisories). Brought to You By Archy Ilya Kulakov Olli J…
This release improves plugin reliability and standards compliance, adding startup timeout to the Kubernetes plugin, fallthrough to gRPC, and EDNS0 unset to rewrite. The file plugin now preserves SRV record case per RFC 6763, route53 is updated to AWS SDK v2, and multiple race conditions in cache and connection handling in forward are fixed. Brought to You By blakebarnett Brennan Kinney Cameron Ste…