CoreDNS

Developer Tools

A DNS server that chains plugins, and the default DNS for Kubernetes.

Latest v1.14.6 · by CNCFWebsitecoredns/coredns

Release activity

Release activity — 10 releases across 9 days since Oct 6, 2025. Each cell is one day; darker means more releases that day. Nothing is recorded before Oct 6, 2025. Older weeks are hidden at this screen width.
MayJunJulAug
SundayNo releases on Apr 26, 2026No releases on May 3, 2026No releases on May 10, 2026No releases on May 17, 2026No releases on May 24, 2026No releases on May 31, 2026No releases on Jun 7, 2026No releases on Jun 14, 2026No releases on Jun 21, 2026No releases on Jun 28, 2026No releases on Jul 5, 2026No releases on Jul 12, 2026No releases on Jul 19, 2026No releases on Jul 26, 2026No releases on Aug 2, 2026No releases on Aug 9, 2026
MondayNo releases on Apr 27, 2026No releases on May 4, 2026No releases on May 11, 2026No releases on May 18, 2026No releases on May 25, 2026No releases on Jun 1, 2026No releases on Jun 8, 2026No releases on Jun 15, 2026No releases on Jun 22, 2026No releases on Jun 29, 2026No releases on Jul 6, 2026No releases on Jul 13, 2026No releases on Jul 20, 2026No releases on Jul 27, 2026No releases on Aug 3, 2026No releases on Aug 10, 2026
TuesdayNo releases on Apr 28, 2026No releases on May 5, 2026No releases on May 12, 2026No releases on May 19, 2026No releases on May 26, 2026No releases on Jun 2, 20261 release on Jun 9, 2026No releases on Jun 16, 2026No releases on Jun 23, 2026No releases on Jun 30, 2026No releases on Jul 7, 2026No releases on Jul 14, 2026No releases on Jul 21, 2026No releases on Jul 28, 2026No releases on Aug 4, 2026
WednesdayNo releases on Apr 29, 2026No releases on May 6, 2026No releases on May 13, 2026No releases on May 20, 2026No releases on May 27, 2026No releases on Jun 3, 2026No releases on Jun 10, 2026No releases on Jun 17, 2026No releases on Jun 24, 2026No releases on Jul 1, 2026No releases on Jul 8, 2026No releases on Jul 15, 2026No releases on Jul 22, 2026No releases on Jul 29, 2026No releases on Aug 5, 2026
ThursdayNo releases on Apr 30, 2026No releases on May 7, 2026No releases on May 14, 2026No releases on May 21, 2026No releases on May 28, 2026No releases on Jun 4, 2026No releases on Jun 11, 2026No releases on Jun 18, 2026No releases on Jun 25, 2026No releases on Jul 2, 2026No releases on Jul 9, 2026No releases on Jul 16, 2026No releases on Jul 23, 2026No releases on Jul 30, 2026No releases on Aug 6, 2026
FridayNo releases on May 1, 2026No releases on May 8, 2026No releases on May 15, 2026No releases on May 22, 2026No releases on May 29, 2026No releases on Jun 5, 2026No releases on Jun 12, 2026No releases on Jun 19, 2026No releases on Jun 26, 2026No releases on Jul 3, 20262 releases on Jul 10, 2026No releases on Jul 17, 2026No releases on Jul 24, 2026No releases on Jul 31, 2026No releases on Aug 7, 2026
SaturdayNo releases on May 2, 2026No releases on May 9, 2026No releases on May 16, 2026No releases on May 23, 2026No releases on May 30, 2026No releases on Jun 6, 2026No releases on Jun 13, 2026No releases on Jun 20, 2026No releases on Jun 27, 2026No releases on Jul 4, 2026No releases on Jul 11, 2026No releases on Jul 18, 2026No releases on Jul 25, 2026No releases on Aug 1, 2026No releases on Aug 8, 2026

10 releases since Oct 6, 2025, busiest day 2

Changelog

v1.14.6

Added 2
  • Add source_address directive to forward plugin
  • Serve catalog member zones in secondary plugin
Changed 1
  • Keep first matching zone file for duplicate origins in auto plugin
Fixed 1
  • Downgrade dd-trace-go to v2.8.2 to fix ARM and MIPS build issues

This patch release focuses on fixing ARM and MIPS build issues introduced in v1.14.5 by downgrading the dd-trace-go dependency, while also including improvements to forwarding and secondary zone support.

Brought to You By

Filippo125 houyuwushang Immanuel Tikhonov Ville Vesilehto Yong Tang

Noteworthy Changes

core: Downgrade dd-trace-go to v2.8.2 (https://github.com/coredns/coredns/pull/8266) plugin/auto: Keep first matching zone file for duplicate origins (https://github.com/coredns/coredns/pull/8216) plugin/forward: Add source_address directive (https://github.com/coredns/coredns/pull/8011) plugin/secondary: Serve catalog member zones (https://github.com/coredns/coredns/pull/8230)

View originalPermalink
How v1.14.6 went

v1.14.5

Added 4
  • Add Config.UDPDecorateWriterFunc for external plugins
  • Add doh support to forward plugin
  • Add wildcard support to hosts plugin
  • Handle names under .localhost. in local plugin
Changed 9
  • Accept scoped IPv6 addresses in transfer targets
  • Bound DoQ stream read with the server read timeout
  • Classify nxdomain without soa as denial
  • Make dnstap FORWARDER_* describe the socket from CoreDNS to upstream
  • Make per-upstream read timeout configurable in forward plugin
  • Parse catalog zones after transfer in secondary plugin
Fixed 19
  • Apply default truncate amount of 2 for bare truncate in erratic plugin
  • Close the previous connection before reconnecting in dnstap
  • Fall through unsupported query types in hosts plugin
  • Fix data race between lookups and reload in hosts plugin
  • Fix nil-pointer panic in EDNS0 response reversion with no OPT record in rewrite plugin
  • Fix panic in CoreDNS transfer plugin caused by empty DNS record

This release improves DNS transport security and operational reliability, with safer DoH/DoH3 handling, enhanced forwarding configuration, and improved dnstap support. It also adds robustness improvements across file serving, secondary zones, transfers, rewrites, hosts handling, and error processing, while fixing several edge cases in DNS response handling.

Brought to You By

Aaron Mark Amirhossein Ebrahimzade Antoine Baltasar Blanco Cedric Wang Ilya Kulakov Immanuel Tikhonov Jaime Hablutzel Jonathan Tooker Omkhar Arasaratnam Pavel Lazureykis SEONGHYUN HONG Saleh Thomas Gosteli Ville Vesilehto Yong Tang houyuwushang rpb-ant

Noteworthy Changes

core: Accept scoped IPv6 addresses in transfer targets (https://github.com/coredns/coredns/pull/8204) core: Bound DoQ stream read with the server read timeout (https://github.com/coredns/coredns/pull/8231) core: Classify nxdomain without soa as denial (https://github.com/coredns/coredns/pull/8199) core: Guard Join against an empty label slice (https://github.com/coredns/coredns/pull/8225) core: Propagate HTTPRequestValidateFunc to all configs in a server block (https://github.com/coredns/coredns/pull/8169) core: Sanitize DoH/DoH3 request parse errors (https://github.com/coredns/coredns/pull/8254) core: Use Go TLS defaults (https://github.com/coredns/coredns/pull/8227) core: Add Config.UDPDecorateWriterFunc for external plugins (https://github.com/coredns/coredns/pull/8257) plugin/auto: Warn on duplicate zone file origins (https://github.com/coredns/coredns/pull/8191) plugin/cache: Add regression test for AD bit not partitioning the cache (https://github.com/coredns/coredns/pull/8214) plugin/dnstap: Close the previous connection before reconnecting (https://github.com/coredns/coredns/pull/8224) plugin/dnstap: Fix self-deadlock in listener broadcast on client flush error (https://github.com/coredns/coredns/pull/8260) plugin/dnstap: Store IPv4-mapped IPv6 addresses as 4 octets with SocketFamily INET (https://github.com/coredns/coredns/pull/8186) plugin/erratic: Apply default truncate amount of 2 for bare truncate (https://github.com/coredns/coredns/pull/8240) plugin/file: Return SOA in authority for negative CNAME target answers (https://github.com/coredns/coredns/pull/8226) plugin/file: Run additional processing for wildcard answers (https://github.com/coredns/coredns/pull/8222) plugin/forward: Add doh support (https://github.com/coredns/coredns/pull/8004) plugin/forward: Make dnstap FORWARDER_* describe the socket from CoreDNS to upstream (https://github.com/coredns/coredns/pull/8184) plugin/forward: Make per-upstream read timeout configurable (https://github.com/coredns/coredns/pull/8205) plugin/forward: Restore old behavior forward plugin continue on empty conf file (https://github.com/coredns/coredns/pull/8203) plugin/hosts: Add wildcard support (https://github.com/coredns/coredns/pull/8185) plugin/hosts: Fall through unsupported query types (https://github.com/coredns/coredns/pull/8193) plugin/hosts: Fix data race between lookups and reload (https://github.com/coredns/coredns/pull/8253) plugin/kubernetes: Fix AXFR panic when nsAddrs returns multiple records (https://github.com/coredns/coredns/pull/8256) plugin/local: Handle names under .localhost. (https://github.com/coredns/coredns/pull/8151) plugin/log: Synthesize deferred error responses (https://github.com/coredns/coredns/pull/8200) plugin/rewrite: Fix nil-pointer panic in EDNS0 response reversion with no OPT record (https://github.com/coredns/coredns/pull/8190) plugin/rewrite: Restore the original question on empty replies (https://github.com/coredns/coredns/pull/8212) plugin/secondary: Parse catalog zones after transfer (https://github.com/coredns/coredns/pull/8209) plugin/secondary: Stop update loop on reload shutdown (https://github.com/coredns/coredns/pull/8198) plugin/trace: Correct Zipkin v2 endpoint docs (https://github.com/coredns/coredns/pull/8202) plugin/transfer: Configure notify source address (https://github.com/coredns/coredns/pull/8192) plugin/transfer: Fix panic in CoreDNS transfer plugin caused by empty DNS record (https://github.com/coredns/coredns/pull/8207) plugin/tsig: Don't echo client's TSIG.Error if verification is successful (https://github.com/coredns/coredns/pull/8215)

View originalPermalink
How v1.14.5 went

v1.14.4

Added 5
  • Add loong64 architecture support
  • Add optional verify timeout to serve_stale in cache plugin
  • Add hostname resolution support for TO endpoints in forward plugin
  • Add incoming connection support in dnstap plugin
  • Add fallthrough support in secondary plugin
Changed 9
  • Allow cache TTLs above default 3600s
  • Bound HTTP/3 request header size for DoH3
  • Expose TLS ConnectionState (SNI) for DoQ
  • Use http.LocalAddrContextKey for DoH local address
  • Apply access mode to every zone in the same block in azure plugin
  • Prefer positive cache over SERVFAIL in ncache
Fixed 4
  • Remove duplicate cipher suites
  • Remove debug fmt.Println from multicluster zone validation in kubernetes plugin
  • Canonicalize escape form in owner names in file plugin
  • Prevent nil pointer dereference when dropping malformed PROXY packets in proxyproto plugin
Removed 2
  • Reject invalid any and local config in any plugin
  • Reject unknown chaos block options in chaos plugin

This release improves transport security and operational flexibility, with enhancements for DoH3 and DoQ, improved DNSSEC signing behavior, and support for the loong64 architecture. It also adds configurable cache verification, hostname resolution for forward targets, incoming connection support for dnstap, fallthrough support in the secondary plugin, automatic zone reloads, and improved forwarding behavior for NODATA responses.

Brought to You By

Cedric Wang Charlie Tonneslan Dmytro Alieksieiev Endre Szabo Immanuel Tikhonov Isolus James R T JUN YANG Jöran Malek Nicholas Amorim Syed Azeez Umut Polat Ville Vesilehto weiguozhang Yong Tang 徐晓伟

Noteworthy Changes
View originalPermalink
How v1.14.4 went

v1.14.3

Added 11
  • Add full TSIG verification in DoH transport
  • Add full TSIG verification in DoH3 transport
  • Add full TSIG verification in QUIC transport
  • Add full TSIG verification in gRPC transport
  • Add support for running CoreDNS as a Windows service
  • Add optional TLS support to /metrics endpoint
Changed 7
  • Preserve TSIG status in gRPC transport
  • Propagate TSIG secrets to DoT server
  • Propagate TSIG status in DoQ transport
  • Avoid spawning waiter goroutines when QUIC worker pool is full
  • Prefetch cache without holding a client connection
  • Expand SVCB/HTTPS record support in file plugin
  • Batch AXFR records by message size instead of count in transfer plugin
Fixed 2
  • Reject oversized GET dns query parameter of DoH
  • Use per-connection local address for PROXY protocol

This release introduces Windows service support, along with full TSIG verification across DoH, DoH3, QUIC, and gRPC transports, and improved TSIG propagation and DoH request validation. It also adds optional TLS for the metrics endpoint. Performance and stability are improved through cache prefetching, QUIC optimizations, and a new max_age option in the forward plugin. Additional updates include enhanced SVCB/HTTPS support, improved zone transfer behavior, and various DNSSEC, PROXY protocol, and concurrency fixes. The release is built with Go 1.26.2, which includes security fixes addressing CVE-2026-32282, CVE-2026-32289, CVE-2026-33810, CVE-2026-27144, CVE-2026-27143, CVE-2026-32288, CVE-2026-32283, and CVE-2026-27140, and also includes fixes for CVE-2026-32936, CVE-2026-33190, CVE-2026-33489, CVE-2026-32934, and CVE-2026-35579.

Brought to You By

andreyrusanov-ec cangming Cedric Wang Ilya Kulakov Ingmar Van Glabbeek John-Michael Mulesa JUN YANG liucongran Minghang Chen Peppi-Lotta rpb-ant Seena Fallah Syed Azeez Umut Polat Ville Vesilehto Yong Tang

Noteworthy Changes
View originalPermalink
How v1.14.3 went

v1.14.2

Added 2
  • Add new proxyproto plugin to support Proxy Protocol and preserve client IPs behind load balancers
  • Add metadata for response Type and Class to Log plugin
Changed 3
  • Update build to Go 1.26.1
  • Allow disabling jitter in reload plugin with 0s
  • Use crypto/rand for query name generation in loop plugin
Fixed 4
  • Fix parsing error when handling TLS+IPv6 address in forward plugin
  • Return SOA and NS records when queried for a record CNAMEd to origin in file plugin
  • Fix CNAME target rewrite for CNAME chains in rewrite plugin
  • Fix panic on empty ListenHosts in kubernetes plugin
Security 2
  • Reorder rewrite before ACL to prevent ACL bypass (CVE-2026-26017)
  • Use stronger randomness for loop detection (CVE-2026-26018)

This release adds the new proxyproto plugin to support Proxy Protocol and preserve client IPs behind load balancers. It also includes enhancements such as improved DNS logging metadata and stronger randomness for loop detection (CVE-2026-26018), along with several bug fixes including TLS+IPv6 forwarding, improved CNAME handling and rewriting, allowing jitter disabling, prevention of an ACL bypass (CVE-2026-26017), and a Kubernetes plugin crash fix. In addition, the release updates the build to Go 1.26.1, which include security fixes addressing CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-25679, and CVE-2026-27142.

Brought to You By

Adphi Henrik Gerdes hide Kelly Kane Shiv Tyagi vflaux Ville Vesilehto yangsenzk Yong Tang YOUNEVSKY

Noteworthy Changes
View originalPermalink
How v1.14.2 went

v1.14.1

Changed 1
  • Use mutex-based connection pool in proxy plugin for performance improvements via multiplexed connections
Security 1
  • Address security vulnerabilities affecting Go versions prior to Go 1.25.6 and Go 1.24.12 (CVE-2025-61728, CVE-2025-61726, CVE-2025-68121, CVE-2025-61731, CVE-2025-68119)

This release primarily addresses security vulnerabilities affecting Go versions prior to Go 1.25.6 and Go 1.24.12 (CVE-2025-61728, CVE-2025-61726, CVE-2025-68121, CVE-2025-61731, CVE-2025-68119). It also includes performance improvements to the proxy plugin via multiplexed connections, along with various documentation updates.

Brought to You By

Alex Massy Shiv Tyagi Ville Vesilehto Yong Tang

Noteworthy Changes
View originalPermalink
How v1.14.1 went

v1.14.0

Added 4
  • Add regex length limit to core to reduce resource-exhaustion risk
  • Add optional show_first flag to errors plugin consolidate directive
  • Add rate limits to Kubernetes API server in kubernetes plugin
  • Implement plugin chain tracking in metrics plugin
Fixed 4
  • Fix gosec G115 integer overflow warnings in core
  • Fix slice init length in azure plugin
  • Fix misleading SOA parser warnings in file plugin
  • Report parser error before missing SOA in sign plugin
Security 1
  • Additional security fixes included in this release

This release focuses on security hardening and operational reliability. Core updates introduce a regex length limit to reduce resource-exhaustion risk. Plugin updates improve error consolidation (show_first), reduce misleading SOA warnings, add Kubernetes API rate limiting, enhance metrics with plugin chain tracking, and fix issues in azure and sign. This release also includes additional security fixes; see the security advisory for details.

Brought to You By

cangming pasteley Raisa Kabir Ross Golder rusttech Syed Azeez Ville Vesilehto Yong Tang

Noteworthy Changes
View originalPermalink
How v1.14.0 went

v1.13.2

Added 6
  • Add basic support for DoH3
  • Add support for per-nameserver TLS SNI in forward plugin
  • Add max connect attempts knob to forward plugin
  • Add ASN schema support to geoip plugin
  • Add support for subdivisions in geoip plugin
  • Support service filtering in nomad plugin
Changed 10
  • Avoid proxy unnecessary alloc in Yield
  • Refactor/use reflect.TypeFor
  • Limit regex length in auto plugin
  • Remove superfluous allocations in cache plugin item.toMsg
  • Isolate metadata in cache plugin prefetch goroutine
  • Better error handling (redial & logging) in dnstap plugin when Dnstap is busy
Fixed 7
  • Fix usage of sync.Pool to save an alloc
  • Fix data race with sync.RWMutex for uniq
  • Prevent QUIC reload panic by lazily initializing the listener
  • Correct spelling of MaximumDefaultTTL in cache and dnsutil packages
  • Prevent busy loop on connection err in forward plugin
  • Fix kubernetes plugin logging
  • Fix reload causing secondary plugin goroutine to leak
Deprecated 1
  • GeoIP plugin will change behavior for missing latitude/longitude: currently returns 0, but will return empty string in next release

This release adds initial support for DoH3 and includes several core performance and stability fixes, including reduced allocations, a resolved data race in uniq, and safer QUIC listener initialization. Plugin updates improve forwarder reliability, extend GeoIP schema support, and fix issues in secondary, nomad, and kubernetes. Cache and file plugins also receive targeted performance tuning.

Deprecations: The GeoIP plugin currently returns 0 for missing latitude/longitude, even though 0,0 is a real location. In the next release, this behavior will change: missing coordinates will return an empty string instead. This avoids conflating “missing” with a real coordinate. Users relying on 0 as a sentinel value should update their logic before this change takes effect. See PR #7732 for reference.

Brought to You By

Alicia Y Andrey Smirnov Brennan Kinney Charlie Vieth Endre Szabo Eric Case Filippo125 Nico Berlee Olli Janatuinen Rick Fletcher Timur Solodovnikov Tomas Boros Ville Vesilehto cangming rpb-ant wencyu wenxuan70 Yong Tang zhetaicheleba

Noteworthy Changes
View originalPermalink
How v1.13.2 went

v1.13.1

Changed 1
  • Avoid string concatenation in loops in core
Fixed 1
  • Reject invalid UTF-8 tokens in sign plugin dbfile
Security 1
  • Update golang to 1.25.2 and golang.org/x/net to v0.45.0 to address multiple high-severity CVEs

This release updates CoreDNS to Go 1.25.2 and golang.org/x/net v0.45.0 to address multiple high-severity CVEs. It also improves core performance by avoiding string concatenation in loops, and hardens the sign plugin by rejecting invalid UTF-8 tokens in dbfile.

Brought to You By

Catena cyber Ville Vesilehto Yong Tang

Noteworthy Changes
View originalPermalink
How v1.13.1 went

v1.13.0

Added 3
  • Add a Nomad plugin for integrating CoreDNS with HashiCorp Nomad
  • Export timeout values in dnsserver.Server
  • Add bounds for plugin args in dnstap plugin
Changed 2
  • Rely on dns.Server.ShutdownContext to gracefully stop
  • No failover to next upstream when receiving SERVFAIL or REFUSED response codes in forward plugin
Fixed 8
  • Fix Corefile infinite loop on unclosed braces
  • Fix Corefile related import cycle issue
  • Normalize panics on invalid origins
  • Fix data race in tree Elem.Name in file plugin
  • Enforce DNS message size limits in grpc plugin
  • Prevent panic when ListenHosts is empty in loop plugin
  • Avoid panic on invalid server block in loop plugin
  • Prevent SIGTERM/reload deadlock in reload plugin

This release introduces a new Nomad plugin for integrating CoreDNS with HashiCorp Nomad. It also fixes major Corefile issues on infinite loops and import cycles, improves shutdown handling, normalizes core panics, addresses data races in the file plugin, enforces gRPC size limits, adjusts forward failover behavior, as well as prevents reload deadlocks.

Brought to You By

Fitz_dev Ilya Kulakov Olli Janatuinen Ville Vesilehto Yong Tang

Noteworthy Changes
View originalPermalink
How v1.13.0 went

More in Developer Tools

View all
yt-dlp

A feature-rich command-line audio/video downloader

yt-dlp
tmux

tmux release notes.

tmux
GitHub CLI

GitHub command-line tool

GitHub
Claude Code

Anthropic's agentic coding tool for the terminal, IDE and web.

Anthropic
Shadowrocket

Rule based proxy utility client for iPhone/iPad.

Shadow Launch Technology Limited
AWS CLI

One tool to manage every AWS service from the command line, and script them.

Amazon Web Services

Discussion