CoreDNS Release Notes

This release strengthens DNS caching, forwarding, and transport reliability, with improved stale-cache behavior, safer upstream handling, and tighter connection and overload controls. It also adds new capabilities for ACME-managed TLS, topology-aware Kubernetes services, HTTP/2 forwarding, DNS-over-QUIC, and secondary zone management, while delivering correctness and performance fixes across file serving, rewrites, ACLs, hosts, transfers, and Kubernetes handling. The release is built with Go 1.26.6 to include fixes for CVE-2026-56865, CVE-2026-56864, and CVE-2026-33818.

Brought to You By

Baltasar Blanco houyuwushang Karan V liucongran llucas Manuel Rüger maximilize Mehrdad Biukian Michael Wolf Ncesam Nikolaus Schuetz Nitin Nizhawan Omkhar Arasaratnam Pujitha Paladugu rpb-ant Saleh Sueun Cho Ville Vesilehto Yash Singh Yong Tang

Noteworthy Changes

core: Add connection-level concurrency limiting to DNS-over-QUIC (https://github.com/coredns/coredns/pull/8213) core: Add max conn limit to https3 (https://github.com/coredns/coredns/pull/8187) core: Document in-process embedding (https://github.com/coredns/coredns/pull/8436) core: Make keylog path test portable (https://github.com/coredns/coredns/pull/8311) core: Normalize server block zones (https://github.com/coredns/coredns/pull/8320) core: Pin numeric uid/gid for the nonroot user (https://github.com/coredns/coredns/pull/8316) …

This patch release focuses on fixing ARM and MIPS build issues introduced in v1.14.5 by downgrading the dd-trace-go dependency, while also including improvements to forwarding and secondary zone support.

Brought to You By

Filippo125 houyuwushang Immanuel Tikhonov Ville Vesilehto Yong Tang

Noteworthy Changes

core: Downgrade dd-trace-go to v2.8.2 (https://github.com/coredns/coredns/pull/8266) plugin/auto: Keep first matching zone file for duplicate origins (https://github.com/coredns/coredns/pull/8216) plugin/forward: Add source_address directive (https://github.com/coredns/coredns/pull/8011) plugin/secondary: Serve catalog member zones (https://github.com/coredns/coredns/pull/8230)

This release improves DNS transport security and operational reliability, with safer DoH/DoH3 handling, enhanced forwarding configuration, and improved dnstap support. It also adds robustness improvements across file serving, secondary zones, transfers, rewrites, hosts handling, and error processing, while fixing several edge cases in DNS response handling.

Brought to You By

Aaron Mark Amirhossein Ebrahimzade Antoine Baltasar Blanco Cedric Wang Ilya Kulakov Immanuel Tikhonov Jaime Hablutzel Jonathan Tooker Omkhar Arasaratnam Pavel Lazureykis SEONGHYUN HONG Saleh Thomas Gosteli Ville Vesilehto Yong Tang houyuwushang rpb-ant

Noteworthy Changes

core: Accept scoped IPv6 addresses in transfer targets (https://github.com/coredns/coredns/pull/8204) core: Bound DoQ stream read with the server read timeout (https://github.com/coredns/coredns/pull/8231) core: Classify nxdomain without soa as denial (https://github.com/coredns/coredns/pull/8199) core: Guard Join against an empty label slice (https://github.com/coredns/coredns/pull/8225) core: Propagate HTTPRequestValidateFunc to all configs in a server block (https://github.com/coredns/coredns/pull/8169) core: Sanitize DoH/DoH3 request parse errors (https://github.com/coredns/coredns/pull/8254) core: Use Go TLS defaults (https://github.com/coredns/coredns/pull/8227) core: Add Config.UDPDecorateWriterFunc for external plugins (https://github.com/coredns/coredns/pull/8257) …

This release improves transport security and operational flexibility, with enhancements for DoH3 and DoQ, improved DNSSEC signing behavior, and support for the loong64 architecture. It also adds configurable cache verification, hostname resolution for forward targets, incoming connection support for dnstap, fallthrough support in the secondary plugin, automatic zone reloads, and improved forwarding behavior for NODATA responses.

Brought to You By

Cedric Wang Charlie Tonneslan Dmytro Alieksieiev Endre Szabo Immanuel Tikhonov Isolus James R T JUN YANG Jöran Malek Nicholas Amorim Syed Azeez Umut Polat Ville Vesilehto weiguozhang Yong Tang 徐晓伟

Noteworthy Changes

• core: Add loong64 arch support (https://github.com/coredns/coredns/pull/8137)
• core: Bound HTTP/3 request header size for DoH3 (https://github.com/coredns/coredns/pull/8135)
• core: Expose TLS ConnectionState (SNI) for DoQ (https://github.com/coredns/coredns/pull/8129)
• core: Remove duplicate cipher suites (https://github.com/coredns/coredns/pull/8118)
• core: Use http.LocalAddrContextKey for DoH local address (https://github.com/coredns/coredns/pull/8149)
• plgin/kubernetes: Remove debug fmt.Println from multicluster zone validation (https://github.com/coredns/coredns/pull/8131)
• plugin/any: Reject invalid any and local config (https://github.com/coredns/coredns/pull/8133) …

This release introduces Windows service support, along with full TSIG verification across DoH, DoH3, QUIC, and gRPC transports, and improved TSIG propagation and DoH request validation. It also adds optional TLS for the metrics endpoint. Performance and stability are improved through cache prefetching, QUIC optimizations, and a new max_age option in the forward plugin. Additional updates include enhanced SVCB/HTTPS support, improved zone transfer behavior, and various DNSSEC, PROXY protocol, and concurrency fixes. The release is built with Go 1.26.2, which includes security fixes addressing CVE-2026-32282, CVE-2026-32289, CVE-2026-33810, CVE-2026-27144, CVE-2026-27143, CVE-2026-32288, CVE-2026-32283, and CVE-2026-27140, and also includes fixes for CVE-2026-32936, CVE-2026-33190, CVE-2026-33489, CVE-2026-32934, and CVE-2026-35579.

Brought to You By

andreyrusanov-ec cangming Cedric Wang Ilya Kulakov Ingmar Van Glabbeek John-Michael Mulesa JUN YANG liucongran Minghang Chen Peppi-Lotta rpb-ant Seena Fallah Syed Azeez Umut Polat Ville Vesilehto Yong Tang

Noteworthy Changes

• core: Add full TSIG verification in DoH transport (https://github.com/coredns/coredns/pull/8013)
• core: Add full TSIG verification in DoH3 transport (https://github.com/coredns/coredns/pull/8044)
• core: Add full TSIG verification in QUIC transport (ttps://github.com/coredns/coredns/pull/8007) …

This release adds the new proxyproto plugin to support Proxy Protocol and preserve client IPs behind load balancers. It also includes enhancements such as improved DNS logging metadata and stronger randomness for loop detection (CVE-2026-26018), along with several bug fixes including TLS+IPv6 forwarding, improved CNAME handling and rewriting, allowing jitter disabling, prevention of an ACL bypass (CVE-2026-26017), and a Kubernetes plugin crash fix. In addition, the release updates the build to Go 1.26.1, which include security fixes addressing CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-25679, and CVE-2026-27142.

Brought to You By

Adphi Henrik Gerdes hide Kelly Kane Shiv Tyagi vflaux Ville Vesilehto yangsenzk Yong Tang YOUNEVSKY

Noteworthy Changes

• core: Reorder rewrite before acl to prevent bypass (https://github.com/coredns/coredns/pull/7882)
• plugin/file: Return SOA and NS records when queried for a record CNAMEd to origin (https://github.com/coredns/coredns/pull/7808)
• plugin/forward: Fix parsing error when handling TLS+IPv6 address (https://github.com/coredns/coredns/pull/7848)
• plugin/log: Add metadata for response Type and Class to Log (https://github.com/coredns/coredns/pull/7806)
• plugin/loop: Use crypto/rand for query name generation (https://github.com/coredns/coredns/pull/7881)
• plugin/kubernetes: Fix panic on empty ListenHosts (https://github.com/coredns/coredns/pull/7857) …

This release focuses on security hardening and operational reliability. Core updates introduce a regex length limit to reduce resource-exhaustion risk. Plugin updates improve error consolidation (show_first), reduce misleading SOA warnings, add Kubernetes API rate limiting, enhance metrics with plugin chain tracking, and fix issues in azure and sign. This release also includes additional security fixes; see the security advisory for details.

Brought to You By

cangming pasteley Raisa Kabir Ross Golder rusttech Syed Azeez Ville Vesilehto Yong Tang

Noteworthy Changes

• core: Fix gosec G115 integer overflow warnings (https://github.com/coredns/coredns/pull/7799)
• core: Add regex length limit (https://github.com/coredns/coredns/pull/7802)
• plugin/azure: Fix slice init length (https://github.com/coredns/coredns/pull/6901)
• plugin/errors: Add optional show_first flag to consolidate directive (https://github.com/coredns/coredns/pull/7703)
• plugin/file: Fix for misleading SOA parser warnings (https://github.com/coredns/coredns/pull/7774)
• plugin/kubernetes: Rate limits to api server (https://github.com/coredns/coredns/pull/7771)
• plugin/metrics: Implement plugin chain tracking (https://github.com/coredns/coredns/pull/7791)
• plugin/sign: Report parser err before missing SOA (https://github.com/coredns/coredns/pull/7775)

This release adds initial support for DoH3 and includes several core performance and stability fixes, including reduced allocations, a resolved data race in uniq, and safer QUIC listener initialization. Plugin updates improve forwarder reliability, extend GeoIP schema support, and fix issues in secondary, nomad, and kubernetes. Cache and file plugins also receive targeted performance tuning.

Deprecations: The GeoIP plugin currently returns 0 for missing latitude/longitude, even though 0,0 is a real location. In the next release, this behavior will change: missing coordinates will return an empty string instead. This avoids conflating “missing” with a real coordinate. Users relying on 0 as a sentinel value should update their logic before this change takes effect. See PR #7732 for reference.

Brought to You By

Alicia Y Andrey Smirnov Brennan Kinney Charlie Vieth Endre Szabo Eric Case Filippo125 Nico Berlee Olli Janatuinen Rick Fletcher Timur Solodovnikov Tomas Boros Ville Vesilehto cangming rpb-ant wencyu wenxuan70 Yong Tang zhetaicheleba

Noteworthy Changes

• core: Add basic support for DoH3 (https://github.com/coredns/coredns/pull/7677)
• core: Avoid proxy unnecessary alloc in Yield (https://github.com/coredns/coredns/pull/7708)
• core: Fix usage of sync.Pool to save an alloc (https://github.com/coredns/coredns/pull/7701)
• core: Fix data race with sync.RWMutex for uniq (https://github.com/coredns/coredns/pull/7707) …

This release updates CoreDNS to Go 1.25.2 and golang.org/x/net v0.45.0 to address multiple high-severity CVEs. It also improves core performance by avoiding string concatenation in loops, and hardens the sign plugin by rejecting invalid UTF-8 tokens in dbfile.

Brought to You By

Catena cyber Ville Vesilehto Yong Tang

Noteworthy Changes

• core: Avoid string concatenation in loops (https://github.com/coredns/coredns/pull/7572)
• core: Update golang to 1.25.2 and golang.org/x/net to v0.45.0 on CVE fixes (https://github.com/coredns/coredns/pull/7598)
• plugin/sign: Reject invalid UTF‑8 dbfile token (https://github.com/coredns/coredns/pull/7589)

This release introduces a new Nomad plugin for integrating CoreDNS with HashiCorp Nomad. It also fixes major Corefile issues on infinite loops and import cycles, improves shutdown handling, normalizes core panics, addresses data races in the file plugin, enforces gRPC size limits, adjusts forward failover behavior, as well as prevents reload deadlocks.

Brought to You By

Fitz_dev Ilya Kulakov Olli Janatuinen Ville Vesilehto Yong Tang

Noteworthy Changes

• core: Export timeout values in dnsserver.Server (https://github.com/coredns/coredns/pull/7497)
• core: Fix Corefile infinite loop on unclosed braces (https://github.com/coredns/coredns/pull/7571)
• core: Fix Corefile related import cycle issue (https://github.com/coredns/coredns/pull/7567)
• core: Normalize panics on invalid origins (https://github.com/coredns/coredns/pull/7563)
• core: Rely on dns.Server.ShutdownContext to gracefully stop (https://github.com/coredns/coredns/pull/7517)
• plugin/dnstap: Add bounds for plugin args (https://github.com/coredns/coredns/pull/7557)
• plugin/file: Fix data race in tree Elem.Name (https://github.com/coredns/coredns/pull/7574)
• plugin/forward: No failover to next upstream when receiving SERVFAIL or REFUSED response codes (https://github.com/coredns/coredns/pull/7458)
• plugin/grpc: Enforce DNS message size limits (https://github.com/coredns/coredns/pull/7490) …

This release improves stability and security, fixing context propagation in DoH, label offset handling in the file plugin, and connection leaks in gRPC and transfer. It also adds support for the prefer option in loadbalance, introduces timeouts to the metrics server, and fixes several security vulnerabilities (see details in related security advisories).

Brought to You By

Archy Ilya Kulakov Olli Janatuinen Qasim Sarfraz Syed Azeez Ville Vesilehto wencyu Yong Tang

Noteworthy Changes

• core: Improve caddy.GracefulServer conformance checks (https://github.com/coredns/coredns/pull/7416)
• core: Propagate HTTP request context in DoH (https://github.com/coredns/coredns/pull/7491)
• plugin/file: Fix label offset problem in ClosestEncloser (https://github.com/coredns/coredns/pull/7465)
• plugin/grpc: Check proxy list length in policies (https://github.com/coredns/coredns/pull/7512)
• plugin/grpc: Fix span leak and deadline on error attempt (https://github.com/coredns/coredns/pull/7487)
• plugin/header: Remove deprecated syntax (https://github.com/coredns/coredns/pull/7436)
• plugin/loadbalance: Support prefer option (https://github.com/coredns/coredns/pull/7433)
• plugin/metrics: Add timeouts to metrics HTTP server (https://github.com/coredns/coredns/pull/7469)
• plugin/trace: Migrate dd-trace-go v1 to v2 (https://github.com/coredns/coredns/pull/7466) …

This release improves plugin reliability and standards compliance, adding startup timeout to the Kubernetes plugin, fallthrough to gRPC, and EDNS0 unset to rewrite. The file plugin now preserves SRV record case per RFC 6763, route53 is updated to AWS SDK v2, and multiple race conditions in cache and connection handling in forward are fixed.

Brought to You By

blakebarnett Brennan Kinney Cameron Steel Dave Brown Dennis Simmons Guillaume Jacquet harshith-2411-2002 houpo-bob Oleg Guba Sebastian Mayr Stephen Kitt Syed Azeez Ville Vesilehto Yong Tang Yoofi Quansah

Noteworthy Changes

• plugin/auto: Return REFUSED when no next plugin is available (https://github.com/coredns/coredns/pull/7381)
• plugin/cache: Create a copy of a response to ensure original msg is never modified (https://github.com/coredns/coredns/pull/7357)
• plugin/cache: Fix data race when refreshing cached messages (https://github.com/coredns/coredns/pull/7398)
• plugin/cache: Fix data race when updating the TTL of cached messages (https://github.com/coredns/coredns/pull/7397)
• plugin/file: Return REFUSED when no next plugin is available (https://github.com/coredns/coredns/pull/7381)
• plugin/file: Preserve case in SRV record names and targets per RFC 6763 (https://github.com/coredns/coredns/pull/7402)
• plugin/forward: Handle cached connection closure in forward plugin (https://github.com/coredns/coredns/pull/7427) …

This release introduces significant improvements to plugin stability and extensibility. It adds multicluster support to the Kubernetes plugin, fallthrough support in the file plugin, and a new SetProxyOptions function for the forward plugin. Notably, the QUIC (DoQ) plugin now limits concurrent streams, improving performance under load. Several bug fixes and optimizations improve reliability across plugins, including rewrite, proxy, and metrics.

Brought to You By

Ambrose Chua, Arthur Outhenin-Chalandre, Ben Kochie, Colden Cullen, Gleb Kogtev, Hirotaka Tagawa, Kevin Lyda, Manuel Rüger, Mark Mickan, Parfenov Ivan, skipper, vdbe, Viktor Oreshkin, Ville Vesilehto, Yannick Epstein, Yong Tang

Noteworthy Changes

• core: Enable plugins via environment during build (https://github.com/coredns/coredns/pull/7310)
• core: Ensure DNS query name reset in plugin.NS error path (https://github.com/coredns/coredns/pull/7142)
• plugin/forward: Added SetProxyOptions function for forward plugin (https://github.com/coredns/coredns/pull/7229)
• plugin/ready: Do not interrupt querying readiness probes for plugins (https://github.com/coredns/coredns/pull/6975)
• plugin/secondary: Make transfer property mandatory (https://github.com/coredns/coredns/pull/7249)
• plugin/rewrite: Truncated upstream response (https://github.com/coredns/coredns/pull/7277)
• plugin/quic: Limit concurrent DoQ streams and goroutines (https://github.com/coredns/coredns/pull/7296) …

In this release:

• kubernetes: Revert recent change to only create PTR records for endpoints with hostname defined.
• forward: added option to return SERVFAIL immediately if all upstreams are unhealthy.

Brought to You By

Adrian Moisey, Arthur Outhenin-Chalandre, Bartosz Borkowski, Ben Kochie, Chris O'Haver, Min Woo Kim, Puneet Loya, Rich, Viktor, momantech

Noteworthy Changes

• core: Increase CNAME lookup limit from 7 to 10 (https://github.com/coredns/coredns/pull/7153)
• plugin/kubernetes: Fix handling of pods having DeletionTimestamp set (https://github.com/coredns/coredns/pull/7119) (#7131)
• plugin/kubernetes: Revert "only create PTR records for endpoints with hostname defined (https://github.com/coredns/coredns/pull/6898)" (#7194)
• plugin/forward: added option failfast_all_unhealthy_upstreams to return servfail if all upstreams are down (https://github.com/coredns/coredns/pull/6999)

This release adds some new features and fixes some bugs. New features of note:

• forward plugin: new option next, to try alternate upstreams when receiving specified response codes upstreams on (functions like the external plugin alternate)
• dnssec plugin: new option to load keys from AWS Secrets Manager
• rewrite plugin: new option to revert EDNS0 option rewrites in responses

Brought to You By

AdamKorcz, Anifalak, Ben Kochie, Chris O'Haver, Frederic Hemery, Grant Spence, Harshita Sao, Jason Joo, Jasper Bernhardt, Johnny Bergström, Keith Coleman, Kevin Lyda, Lan, Lin-1997, Manuel Rüger, Nathan Currier, Nicolai Søborg, Nikita Usatov, Paco Xu, Reinhard Nägele, Robbie Ostrow, TAKAHASHI Shuuji, Till Riedel, Tobias Klauser, YASH JAIN, cedar-gao, chenylh, wmkuipers, xinbenlv, zhangguanzhang

Noteworthy Changes

• core: set cache-control max-age as integer, not float (https://github.com/coredns/coredns/pull/6764)
• plugin/metadata: evaluate metadata in plugin order (https://github.com/coredns/coredns/pull/6729)
• plugin/dnssec: dnssec load keys from AWS Secrets Manager (https://github.com/coredns/coredns/pull/6618)
• plugin/rewrite: Add "revert" parameter for EDNS0 options (https://github.com/coredns/coredns/pull/6893)
• container: Restored backwards compatibility of Current Workdir (https://github.com/coredns/coredns/pull/6731) …

This release contains some new features, bug fixes, and package updates. Because of the deployment issues with the previous release, all changed features from 1.11.2 have been included in this release. New features include:

• When the forward plugin receives a malformed upstream response that overflows, it will now send an empty response to the client with the truncated (TC) bit set to prompt the client to retry over TCP.
• The rewrite plugin can now rewrite response codes.
• The dnstap plugin now supports adding metadata to the dnstap extra field.

Brought to You By

Amila Senadheera, Ben Kochie, Benjamin, Chris O'Haver, Grant Spence, John Belamaric, Keita Kitamura, Marius Kimmina, Michael Grosser, Ondřej Benkovský, P. Radha Krishna, Rahil Bhimjiani, Sri Harsha, Tom Thorogood, Willow (GHOST), Yong Tang, Yuheng, Zhizhen He, guangwu, journey-c, pschou Ted Ford

Noteworthy Changes

• plugin/tls: respect the path specified by root plugin (https://github.com/coredns/coredns/pull/6138)
• plugin/auto: warn when auto is unable to read elements of the directory tree (https://github.com/coredns/coredns/pull/6333)
• plugin/etcd: the etcd client adds the DialKeepAliveTime parameter (https://github.com/coredns/coredns/pull/6351)
• plugin/cache: key cache on Checking Disabled (CD) bit (https://github.com/coredns/coredns/pull/6354) …

This release fixes a major performance regression introduced in 1.11.0 that affected DoT (TLS) forwarded connections. It also adds a new option to dnstap to add metadata to the dnstap extra field, and fixes a config parsing bug in cache.

Brought to You By

Chris O'Haver, P. Radha Krishna, Yong Tang, Yuheng, Zhizhen He

Noteworthy Changes

• Revert "plugin/forward: Continue waiting after receiving malformed responses (https://github.com/coredns/coredns/pull/6014)" (#6270)
• plugin/dnstap: add support for "extra" field in payload (https://github.com/coredns/coredns/pull/6226)
• plugin/cache: fix keepttl parsing (https://github.com/coredns/coredns/pull/6250)

Release Highlights

• Adds support for accepting DNS connections over QUIC (doq).
• Adds CNAME target rewrites to the rewrite plugin.
• Plus many bug fixes, and some security improvements.

This release introduces the following backward incompatible changes:

• In the kubernetes plugin, we have dropped support for watching Endpoint and Endpointslice v1beta, since all supported K8s versions now use Endpointslice.
• The bufsize plugin changed its default size limit value to 1232
• Some changes to forward plugin metrics.

Brought to You By

Amila Senadheera, Antony Chazapis, Ayato Tokubi, Ben Kochie, Catena cyber, Chris O'Haver, Dan Salmon, Dan Wilson, Denis MACHARD, Diogenes Pelisson, Eng Zer Jun, Fish-pro, Gabor Dozsa, Gary McDonald, João Henri, Justin, Lio李歐, Marcos Mendez, Marius Kimmina, Ondřej Benkovský, Pat Downey, Petr Menšík, Rotem Kfir, Sebastian Dahlgren, Vancl, Vinayak Goyal, W. Trevor King, Yash Singh, Yashpal, Yong Tang, Yuheng, cui fliter, jeremiejig, junhwong, rokkiter, yyzxw

Other Noteworthy Changes

• add support for RISC-V (https://github.com/coredns/coredns/pull/6195)
• doh: allow http as the protocol (https://github.com/coredns/coredns/pull/5762)
• doq: add DNS-Over-QUIC server support (https://github.com/coredns/coredns/pull/6182)
• plugin/bufsize: change default value to 1232 (https://github.com/coredns/coredns/pull/6183) …