# CoreDNS changelog

> A DNS server that chains plugins, and the default DNS for Kubernetes.

- Vendor: CNCF
- Category: Developer Tools
- Official site: https://coredns.io
- Tracked by: What's New (https://whatsnew.fyi/product/coredns)
- Harvested from: GitHub (coredns/coredns)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### v1.14.6

- Date: 2026-07-10
- Version: v1.14.6
- Original notes: https://github.com/coredns/coredns/releases/tag/v1.14.6
- Permalink: https://whatsnew.fyi/product/coredns/releases/v1.14.6

- **fixed** — Downgrade dd-trace-go to v2.8.2 to fix ARM and MIPS build issues
- **changed** — Keep first matching zone file for duplicate origins in auto plugin
- **added** — Add source_address directive to forward plugin
- **added** — Serve catalog member zones in secondary plugin

This patch release focuses on fixing ARM and MIPS build issues introduced in
v1.14.5 by downgrading the dd-trace-go dependency, while also including
improvements to forwarding and secondary zone support.

##### Brought to You By

Filippo125
houyuwushang
Immanuel Tikhonov
Ville Vesilehto
Yong Tang

##### Noteworthy Changes

core: Downgrade dd-trace-go to v2.8.2 (https://github.com/coredns/coredns/pull/8266)
plugin/auto: Keep first matching zone file for duplicate origins (https://github.com/coredns/coredns/pull/8216)
plugin/forward: Add source_address directive (https://github.com/coredns/coredns/pull/8011)
plugin/secondary: Serve catalog member zones (https://github.com/coredns/coredns/pull/8230)

### v1.14.5

- Date: 2026-07-10
- Version: v1.14.5
- Original notes: https://github.com/coredns/coredns/releases/tag/v1.14.5
- Permalink: https://whatsnew.fyi/product/coredns/releases/v1.14.5

- **added** — Add Config.UDPDecorateWriterFunc for external plugins
- **added** — Add doh support to forward plugin
- **added** — Add wildcard support to hosts plugin
- **added** — Handle names under .localhost. in local plugin
- **changed** — Accept scoped IPv6 addresses in transfer targets
- **changed** — Bound DoQ stream read with the server read timeout
- **changed** — Classify nxdomain without soa as denial
- **changed** — Make dnstap FORWARDER_* describe the socket from CoreDNS to upstream
- **changed** — Make per-upstream read timeout configurable in forward plugin
- **changed** — Parse catalog zones after transfer in secondary plugin
- **changed** — Restore old behavior forward plugin continue on empty conf file
- **changed** — Store IPv4-mapped IPv6 addresses as 4 octets with SocketFamily INET in dnstap
- **changed** — Use Go TLS defaults
- **fixed** — Apply default truncate amount of 2 for bare truncate in erratic plugin
- **fixed** — Close the previous connection before reconnecting in dnstap
- **fixed** — Fall through unsupported query types in hosts plugin
- **fixed** — Fix data race between lookups and reload in hosts plugin
- **fixed** — Fix nil-pointer panic in EDNS0 response reversion with no OPT record in rewrite plugin
- **fixed** — Fix panic in CoreDNS transfer plugin caused by empty DNS record
- **fixed** — Fix panic in AXFR when nsAddrs returns multiple records in kubernetes plugin
- **fixed** — Fix self-deadlock in listener broadcast on client flush error in dnstap
- **fixed** — Guard Join against an empty label slice
- **fixed** — Propagate HTTPRequestValidateFunc to all configs in a server block
- **fixed** — Return SOA in authority for negative CNAME target answers in file plugin
- **fixed** — Restore the original question on empty replies in rewrite plugin
- **fixed** — Run additional processing for wildcard answers in file plugin
- **fixed** — Sanitize DoH/DoH3 request parse errors
- **fixed** — Stop update loop on reload shutdown in secondary plugin
- **fixed** — Synthesize deferred error responses in log plugin
- **fixed** — Configure notify source address in transfer plugin
- **fixed** — Don't echo client's TSIG.Error if verification is successful in tsig plugin
- **fixed** — Warn on duplicate zone file origins in auto plugin

This release improves DNS transport security and operational reliability, with
safer DoH/DoH3 handling, enhanced forwarding configuration, and improved dnstap
support. It also adds robustness improvements across file serving, secondary
zones, transfers, rewrites, hosts handling, and error processing, while fixing
several edge cases in DNS response handling.

##### Brought to You By

Aaron Mark
Amirhossein Ebrahimzade
Antoine
Baltasar Blanco
Cedric Wang
Ilya Kulakov
Immanuel Tikhonov
Jaime Hablutzel
Jonathan Tooker
Omkhar Arasaratnam
Pavel Lazureykis
SEONGHYUN HONG
Saleh
Thomas Gosteli
Ville Vesilehto
Yong Tang
houyuwushang
rpb-ant

##### Noteworthy Changes

core: Accept scoped IPv6 addresses in transfer targets (https://github.com/coredns/coredns/pull/8204)
core: Bound DoQ stream read with the server read timeout (https://github.com/coredns/coredns/pull/8231)
core: Classify nxdomain without soa as denial (https://github.com/coredns/coredns/pull/8199)
core: Guard Join against an empty label slice (https://github.com/coredns/coredns/pull/8225)
core: Propagate HTTPRequestValidateFunc to all configs in a server block (https://github.com/coredns/coredns/pull/8169)
core: Sanitize DoH/DoH3 request parse errors (https://github.com/coredns/coredns/pull/8254)
core: Use Go TLS defaults (https://github.com/coredns/coredns/pull/8227)
core: Add Config.UDPDecorateWriterFunc for external plugins (https://github.com/coredns/coredns/pull/8257)
plugin/auto: Warn on duplicate zone file origins (https://github.com/coredns/coredns/pull/8191)
plugin/cache: Add regression test for AD bit not partitioning the cache (https://github.com/coredns/coredns/pull/8214)
plugin/dnstap: Close the previous connection before reconnecting (https://github.com/coredns/coredns/pull/8224)
plugin/dnstap: Fix self-deadlock in listener broadcast on client flush error (https://github.com/coredns/coredns/pull/8260)
plugin/dnstap: Store IPv4-mapped IPv6 addresses as 4 octets with SocketFamily INET (https://github.com/coredns/coredns/pull/8186)
plugin/erratic: Apply default truncate amount of 2 for bare `truncate` (https://github.com/coredns/coredns/pull/8240)
plugin/file: Return SOA in authority for negative CNAME target answers (https://github.com/coredns/coredns/pull/8226)
plugin/file: Run additional processing for wildcard answers (https://github.com/coredns/coredns/pull/8222)
plugin/forward: Add doh support (https://github.com/coredns/coredns/pull/8004)
plugin/forward: Make dnstap FORWARDER_* describe the socket from CoreDNS to upstream (https://github.com/coredns/coredns/pull/8184)
plugin/forward: Make per-upstream read timeout configurable (https://github.com/coredns/coredns/pull/8205)
plugin/forward: Restore old behavior forward plugin continue on empty conf file (https://github.com/coredns/coredns/pull/8203)
plugin/hosts: Add wildcard support (https://github.com/coredns/coredns/pull/8185)
plugin/hosts: Fall through unsupported query types (https://github.com/coredns/coredns/pull/8193)
plugin/hosts: Fix data race between lookups and reload (https://github.com/coredns/coredns/pull/8253)
plugin/kubernetes: Fix AXFR panic when nsAddrs returns multiple records (https://github.com/coredns/coredns/pull/8256)
plugin/local: Handle names under .localhost. (https://github.com/coredns/coredns/pull/8151)
plugin/log: Synthesize deferred error responses (https://github.com/coredns/coredns/pull/8200)
plugin/rewrite: Fix nil-pointer panic in EDNS0 response reversion with no OPT record (https://github.com/coredns/coredns/pull/8190)
plugin/rewrite: Restore the original question on empty replies (https://github.com/coredns/coredns/pull/8212)
plugin/secondary: Parse catalog zones after transfer (https://github.com/coredns/coredns/pull/8209)
plugin/secondary: Stop update loop on reload shutdown (https://github.com/coredns/coredns/pull/8198)
plugin/trace: Correct Zipkin v2 endpoint docs (https://github.com/coredns/coredns/pull/8202

_[Truncated at 4000 characters — full notes: https://github.com/coredns/coredns/releases/tag/v1.14.5]_

### v1.14.4

- Date: 2026-06-09
- Version: v1.14.4
- Original notes: https://github.com/coredns/coredns/releases/tag/v1.14.4
- Permalink: https://whatsnew.fyi/product/coredns/releases/v1.14.4

- **added** — Add loong64 architecture support
- **added** — Add optional verify timeout to serve_stale in cache plugin
- **added** — Add hostname resolution support for TO endpoints in forward plugin
- **added** — Add incoming connection support in dnstap plugin
- **added** — Add fallthrough support in secondary plugin
- **changed** — Allow cache TTLs above default 3600s
- **changed** — Bound HTTP/3 request header size for DoH3
- **changed** — Expose TLS ConnectionState (SNI) for DoQ
- **changed** — Use http.LocalAddrContextKey for DoH local address
- **changed** — Apply access mode to every zone in the same block in azure plugin
- **changed** — Prefer positive cache over SERVFAIL in ncache
- **changed** — Sign each RRset with the zone that owns its name, not the query zone in dnssec plugin
- **changed** — Trigger reload of zones based on mtime in file plugin
- **changed** — Forward NODATA responses to Next handler in forward plugin
- **fixed** — Remove duplicate cipher suites
- **fixed** — Remove debug fmt.Println from multicluster zone validation in kubernetes plugin
- **fixed** — Canonicalize escape form in owner names in file plugin
- **fixed** — Prevent nil pointer dereference when dropping malformed PROXY packets in proxyproto plugin
- **removed** — Reject invalid any and local config in any plugin
- **removed** — Reject unknown chaos block options in chaos plugin

This release improves transport security and operational flexibility, with
enhancements for DoH3 and DoQ, improved DNSSEC signing behavior, and support for
the loong64 architecture. It also adds configurable cache verification, hostname
resolution for forward targets, incoming connection support for dnstap, fallthrough
support in the secondary plugin, automatic zone reloads, and improved forwarding
behavior for NODATA responses.

##### Brought to You By

Cedric Wang
Charlie Tonneslan
Dmytro Alieksieiev
Endre Szabo
Immanuel Tikhonov
Isolus
James R T
JUN YANG
Jöran Malek
Nicholas Amorim
Syed Azeez
Umut Polat
Ville Vesilehto
weiguozhang
Yong Tang
徐晓伟

##### Noteworthy Changes

* core: Add loong64 arch support (https://github.com/coredns/coredns/pull/8137)
* core: Bound HTTP/3 request header size for DoH3 (https://github.com/coredns/coredns/pull/8135)
* core: Expose TLS ConnectionState (SNI) for DoQ (https://github.com/coredns/coredns/pull/8129)
* core: Remove duplicate cipher suites (https://github.com/coredns/coredns/pull/8118)
* core: Use http.LocalAddrContextKey for DoH local address (https://github.com/coredns/coredns/pull/8149)
* plgin/kubernetes: Remove debug fmt.Println from multicluster zone validation (https://github.com/coredns/coredns/pull/8131)
* plugin/any: Reject invalid any and local config (https://github.com/coredns/coredns/pull/8133)
* plugin/azure: Apply `access` mode to every zone in the same block (https://github.com/coredns/coredns/pull/8110)
* plugin/cache: Add optional verify timeout to serve_stale (https://github.com/coredns/coredns/pull/8070)
* plugin/cache: Allow cache TTLs above default 3600s (https://github.com/coredns/coredns/pull/8134)
* plugin/cache: Prefer positive cache over SERVFAIL in ncache (https://github.com/coredns/coredns/pull/8003)
* plugin/chaos: Reject unknown chaos block options (https://github.com/coredns/coredns/pull/8121)
* plugin/dnssec: Sign each RRset with the zone that owns its name, not the query zone (https://github.com/coredns/coredns/pull/8138)
* plugin/dnstap: Feature: Added incoming connection support (https://github.com/coredns/coredns/pull/8086)
* plugin/file: Canonicalize escape form in owner names (https://github.com/coredns/coredns/pull/8109)
* plugin/file: Trigger reload of zones based on mtime (https://github.com/coredns/coredns/pull/8085)
* plugin/forward: Add hostname resolution support for TO endpoints (https://github.com/coredns/coredns/pull/5646) (https://github.com/coredns/coredns/pull/7923)
* plugin/forward: Forward NODATA responses to Next handler (https://github.com/coredns/coredns/pull/8065)
* plugin/health: Use descriptive error for unknown block options in health and log plugins (https://github.com/coredns/coredns/pull/8128)
* plugin/ready: Reject unknown ready plugin properties (https://github.com/coredns/coredns/pull/8119)
* plugin/proxyproto: Prevent nil pointer dereference when dropping malformed PROXY packets (https://github.com/coredns/coredns/pull/8154)
* plugin/secondary: Add fallthrough support (https://github.com/coredns/coredns/pull/8041)
* plugin/trace: Reject unknown trace and dnstap block options (https://github.com/coredns/coredns/pull/8120)

### v1.14.3

- Date: 2026-04-22
- Version: v1.14.3
- Original notes: https://github.com/coredns/coredns/releases/tag/v1.14.3
- Permalink: https://whatsnew.fyi/product/coredns/releases/v1.14.3

- **added** — Add full TSIG verification in DoH transport
- **added** — Add full TSIG verification in DoH3 transport
- **added** — Add full TSIG verification in QUIC transport
- **added** — Add full TSIG verification in gRPC transport
- **added** — Add support for running CoreDNS as a Windows service
- **added** — Add optional TLS support to /metrics endpoint
- **added** — Add max_age option to forward plugin to enforce an absolute connection lifetime
- **added** — Add the keylog option to configure TLSConfig.KeyLogWriter in TLS plugin
- **added** — Add require_opcode directive for opcode-based TSIG
- **added** — Add UDP session tracking for Cloudflare Spectrum PPv2 in proxyproto
- **added** — Allow selectively exporting all Go runtime metrics in metrics plugin
- **changed** — Preserve TSIG status in gRPC transport
- **changed** — Propagate TSIG secrets to DoT server
- **changed** — Propagate TSIG status in DoQ transport
- **changed** — Avoid spawning waiter goroutines when QUIC worker pool is full
- **changed** — Prefetch cache without holding a client connection
- **changed** — Expand SVCB/HTTPS record support in file plugin
- **changed** — Batch AXFR records by message size instead of count in transfer plugin
- **fixed** — Reject oversized GET dns query parameter of DoH
- **fixed** — Use per-connection local address for PROXY protocol

This release introduces Windows service support, along with full TSIG verification
across DoH, DoH3, QUIC, and gRPC transports, and improved TSIG propagation and DoH
request validation. It also adds optional TLS for the metrics endpoint. Performance
and stability are improved through cache prefetching, QUIC optimizations, and a new
max_age option in the forward plugin. Additional updates include enhanced SVCB/HTTPS
support, improved zone transfer behavior, and various DNSSEC, PROXY protocol, and
concurrency fixes. The release is built with Go 1.26.2, which includes security
fixes addressing CVE-2026-32282, CVE-2026-32289, CVE-2026-33810, CVE-2026-27144,
CVE-2026-27143, CVE-2026-32288, CVE-2026-32283, and CVE-2026-27140, and also includes
fixes for CVE-2026-32936, CVE-2026-33190, CVE-2026-33489, CVE-2026-32934, and CVE-2026-35579.

##### Brought to You By

andreyrusanov-ec
cangming
Cedric Wang
Ilya Kulakov
Ingmar Van Glabbeek
John-Michael Mulesa
JUN YANG
liucongran
Minghang Chen
Peppi-Lotta
rpb-ant
Seena Fallah
Syed Azeez
Umut Polat
Ville Vesilehto
Yong Tang

##### Noteworthy Changes

* core: Add full TSIG verification in DoH transport (https://github.com/coredns/coredns/pull/8013)
* core: Add full TSIG verification in DoH3 transport (https://github.com/coredns/coredns/pull/8044)
* core: Add full TSIG verification in QUIC transport (ttps://github.com/coredns/coredns/pull/8007)
* core: Add full TSIG verification in gRPC transport (https://github.com/coredns/coredns/pull/8006)
* core: Add support for running CoreDNS as a Windows service (https://github.com/coredns/coredns/pull/7962)
* core: Avoid spawning waiter goroutines when QUIC worker pool is full (https://github.com/coredns/coredns/pull/7927)
* core: Preserve TSIG status in gRPC transport (https://github.com/coredns/coredns/pull/7943)
* core: Propagate TSIG secrets to DoT server (https://github.com/coredns/coredns/pull/7928)
* core: Propagate TSIG status in DoQ transport (https://github.com/coredns/coredns/pull/7947)
* core: Reject oversized GET dns query parameter of DoH (https://github.com/coredns/coredns/pull/7926)
* core: Use per-connection local address for PROXY protocol (https://github.com/coredns/coredns/pull/8005)
* plugin/auto: Resolve symlinked directory before walk (https://github.com/coredns/coredns/pull/8032)
* plugin/cache: Add an atomic.Bool to singleflight prefetching (https://github.com/coredns/coredns/pull/7963)
* plugin/cache: Prefetch without holding a client connection (https://github.com/coredns/coredns/pull/7944)
* plugin/dnssec: Add defensive nil checks (https://github.com/coredns/coredns/pull/7997)
* plugin/dnssec: Avoid caching empty signing results (https://github.com/coredns/coredns/pull/7996)
* plugin/dnssec: Return nil from ParseKeyFile on error (https://github.com/coredns/coredns/pull/8000)
* plugin/dnssec: Return nil sigs on sign error (https://github.com/coredns/coredns/pull/7999)
* plugin/dnsserver: Allow view server blocks in any declaration order (https://github.com/coredns/coredns/pull/8001)
* plugin/file: Expand SVCB/HTTPS record support (https://github.com/coredns/coredns/pull/7950)
* plugin/file: Fix data race in xfr.go (https://github.com/coredns/coredns/pull/8039)
* plugin/file: Introduce snapshot()/setData() accessors for zone data (https://github.com/coredns/coredns/pull/8040)
* plugin/file: Protect Zone.Expired with mutex (https://github.com/coredns/coredns/pull/7940)
* plugin/forward: Add max_age option to enforce an absolute connection lifetime (https://github.com/coredns/coredns/pull/7903)
* plugin/kubernetes: Record cluster_ip services in dns_programming_duration metric (https://github.com/coredns/coredns/pull/7951)
* plugin/kubernetes: Sanitize non-UTF-8 host in metrics (https://github.com/coredns/coredns/pull/7998)
* plugin/metrics: Add optional TLS support to /metrics endpoint (https://github.com/coredns/coredns/pull/7255)
* plugin/metrics: Allow selectively expor

_[Truncated at 4000 characters — full notes: https://github.com/coredns/coredns/releases/tag/v1.14.3]_

### v1.14.2

- Date: 2026-03-06
- Version: v1.14.2
- Original notes: https://github.com/coredns/coredns/releases/tag/v1.14.2
- Permalink: https://whatsnew.fyi/product/coredns/releases/v1.14.2

- **added** — Add new proxyproto plugin to support Proxy Protocol and preserve client IPs behind load balancers
- **added** — Add metadata for response Type and Class to Log plugin
- **changed** — Update build to Go 1.26.1
- **changed** — Allow disabling jitter in reload plugin with 0s
- **changed** — Use crypto/rand for query name generation in loop plugin
- **fixed** — Fix parsing error when handling TLS+IPv6 address in forward plugin
- **fixed** — Return SOA and NS records when queried for a record CNAMEd to origin in file plugin
- **fixed** — Fix CNAME target rewrite for CNAME chains in rewrite plugin
- **fixed** — Fix panic on empty ListenHosts in kubernetes plugin
- **security** — Reorder rewrite before ACL to prevent ACL bypass (CVE-2026-26017)
- **security** — Use stronger randomness for loop detection (CVE-2026-26018)

This release adds the new proxyproto plugin to support Proxy Protocol and preserve
client IPs behind load balancers. It also includes enhancements such as improved DNS
logging metadata and stronger randomness for loop detection (CVE-2026-26018), along
with several bug fixes including TLS+IPv6 forwarding, improved CNAME handling and
rewriting, allowing jitter disabling, prevention of an ACL bypass (CVE-2026-26017),
and a Kubernetes plugin crash fix. In addition, the release updates the build to
Go 1.26.1, which include security fixes addressing CVE-2026-27137, CVE-2026-27138, CVE-2026-27139,
CVE-2026-25679, and CVE-2026-27142.

##### Brought to You By

Adphi
Henrik Gerdes
hide
Kelly Kane
Shiv Tyagi
vflaux
Ville Vesilehto
yangsenzk
Yong Tang
YOUNEVSKY

##### Noteworthy Changes

* core: Reorder rewrite before acl to prevent bypass (https://github.com/coredns/coredns/pull/7882)
* plugin/file: Return SOA and NS records when queried for a record CNAMEd to origin (https://github.com/coredns/coredns/pull/7808)
* plugin/forward: Fix parsing error when handling TLS+IPv6 address (https://github.com/coredns/coredns/pull/7848)
* plugin/log: Add metadata for response Type and Class to Log (https://github.com/coredns/coredns/pull/7806)
* plugin/loop: Use crypto/rand for query name generation (https://github.com/coredns/coredns/pull/7881)
* plugin/kubernetes: Fix panic on empty ListenHosts (https://github.com/coredns/coredns/pull/7857)
* plugin/proxyproto: Add proxy protocol support (https://github.com/coredns/coredns/pull/7738)
* plugin/reload: Allow disabling jitter with 0s (https://github.com/coredns/coredns/pull/7896)
* plugin/rewrite: Fix cname target rewrite for CNAME chains (https://github.com/coredns/coredns/pull/7853)

### v1.14.1

- Date: 2026-01-16
- Version: v1.14.1
- Original notes: https://github.com/coredns/coredns/releases/tag/v1.14.1
- Permalink: https://whatsnew.fyi/product/coredns/releases/v1.14.1

- **security** — Address security vulnerabilities affecting Go versions prior to Go 1.25.6 and Go 1.24.12 (CVE-2025-61728, CVE-2025-61726, CVE-2025-68121, CVE-2025-61731, CVE-2025-68119)
- **changed** — Use mutex-based connection pool in proxy plugin for performance improvements via multiplexed connections

This release primarily addresses security vulnerabilities affecting Go versions prior to
Go 1.25.6 and Go 1.24.12 (CVE-2025-61728, CVE-2025-61726, CVE-2025-68121, CVE-2025-61731,
CVE-2025-68119). It also includes performance improvements to the proxy plugin via
multiplexed connections, along with various documentation updates.

##### Brought to You By

Alex Massy
Shiv Tyagi
Ville Vesilehto
Yong Tang

##### Noteworthy Changes

* plugin/proxy: Use mutex-based connection pool (https://github.com/coredns/coredns/pull/7790)

### v1.14.0

- Date: 2026-01-08
- Version: v1.14.0
- Original notes: https://github.com/coredns/coredns/releases/tag/v1.14.0
- Permalink: https://whatsnew.fyi/product/coredns/releases/v1.14.0

- **fixed** — Fix gosec G115 integer overflow warnings in core
- **added** — Add regex length limit to core to reduce resource-exhaustion risk
- **fixed** — Fix slice init length in azure plugin
- **added** — Add optional show_first flag to errors plugin consolidate directive
- **fixed** — Fix misleading SOA parser warnings in file plugin
- **added** — Add rate limits to Kubernetes API server in kubernetes plugin
- **added** — Implement plugin chain tracking in metrics plugin
- **fixed** — Report parser error before missing SOA in sign plugin
- **security** — Additional security fixes included in this release

This release focuses on security hardening and operational reliability. Core updates
introduce a regex length limit to reduce resource-exhaustion risk. Plugin updates
improve error consolidation (`show_first`), reduce misleading SOA warnings, add
Kubernetes API rate limiting, enhance metrics with plugin chain tracking, and fix
issues in azure and sign. This release also includes additional security fixes;
see the security advisory for details.

##### Brought to You By

cangming
pasteley
Raisa Kabir
Ross Golder
rusttech
Syed Azeez
Ville Vesilehto
Yong Tang

##### Noteworthy Changes

* core: Fix gosec G115 integer overflow warnings (https://github.com/coredns/coredns/pull/7799)
* core: Add regex length limit (https://github.com/coredns/coredns/pull/7802)
* plugin/azure: Fix slice init length (https://github.com/coredns/coredns/pull/6901)
* plugin/errors: Add optional `show_first` flag to consolidate directive (https://github.com/coredns/coredns/pull/7703)
* plugin/file: Fix for misleading SOA parser warnings (https://github.com/coredns/coredns/pull/7774)
* plugin/kubernetes: Rate limits to api server (https://github.com/coredns/coredns/pull/7771)
* plugin/metrics: Implement plugin chain tracking (https://github.com/coredns/coredns/pull/7791)
* plugin/sign: Report parser err before missing SOA (https://github.com/coredns/coredns/pull/7775)

### v1.13.2

- Date: 2025-12-10
- Version: v1.13.2
- Original notes: https://github.com/coredns/coredns/releases/tag/v1.13.2
- Permalink: https://whatsnew.fyi/product/coredns/releases/v1.13.2

- **added** — Add basic support for DoH3
- **changed** — Avoid proxy unnecessary alloc in Yield
- **fixed** — Fix usage of sync.Pool to save an alloc
- **fixed** — Fix data race with sync.RWMutex for uniq
- **fixed** — Prevent QUIC reload panic by lazily initializing the listener
- **changed** — Refactor/use reflect.TypeFor
- **changed** — Limit regex length in auto plugin
- **changed** — Remove superfluous allocations in cache plugin item.toMsg
- **changed** — Isolate metadata in cache plugin prefetch goroutine
- **fixed** — Correct spelling of MaximumDefaultTTL in cache and dnsutil packages
- **changed** — Better error handling (redial & logging) in dnstap plugin when Dnstap is busy
- **changed** — Performance finetuning in file plugin
- **changed** — Disallow NOERROR in forward plugin failover
- **added** — Add support for per-nameserver TLS SNI in forward plugin
- **fixed** — Prevent busy loop on connection err in forward plugin
- **added** — Add max connect attempts knob to forward plugin
- **added** — Add ASN schema support to geoip plugin
- **added** — Add support for subdivisions in geoip plugin
- **fixed** — Fix kubernetes plugin logging
- **changed** — Cap num sockets in multisocket plugin to prevent OOM
- **added** — Support service filtering in nomad plugin
- **changed** — Pre-compile CNAME rewrite regexp in rewrite plugin
- **fixed** — Fix reload causing secondary plugin goroutine to leak
- **deprecated** — GeoIP plugin will change behavior for missing latitude/longitude: currently returns 0, but will return empty string in next release

This release adds initial support for DoH3 and includes several core performance and stability
fixes, including reduced allocations, a resolved data race in uniq, and safer QUIC listener
initialization. Plugin updates improve forwarder reliability, extend GeoIP schema support,
and fix issues in secondary, nomad, and kubernetes. Cache and file plugins also receive
targeted performance tuning.

Deprecations: The GeoIP plugin currently returns 0 for missing latitude/longitude, even though
0,0 is a real location. In the next release, this behavior will change: missing coordinates
will return an empty string instead. This avoids conflating “missing” with a real coordinate.
Users relying on 0 as a sentinel value should update their logic before this change takes effect.
See PR #7732 for reference.

##### Brought to You By

Alicia Y
Andrey Smirnov
Brennan Kinney
Charlie Vieth
Endre Szabo
Eric Case
Filippo125
Nico Berlee
Olli Janatuinen
Rick Fletcher
Timur Solodovnikov
Tomas Boros
Ville Vesilehto
cangming
rpb-ant
wencyu
wenxuan70
Yong Tang
zhetaicheleba

##### Noteworthy Changes

* core: Add basic support for DoH3 (https://github.com/coredns/coredns/pull/7677)
* core: Avoid proxy unnecessary alloc in Yield (https://github.com/coredns/coredns/pull/7708)
* core: Fix usage of sync.Pool to save an alloc (https://github.com/coredns/coredns/pull/7701)
* core: Fix data race with sync.RWMutex for uniq (https://github.com/coredns/coredns/pull/7707)
* core: Prevent QUIC reload panic by lazily initializing the listener (https://github.com/coredns/coredns/pull/7680)
* core: Refactor/use reflect.TypeFor (https://github.com/coredns/coredns/pull/7696)
* plugin/auto: Limit regex length (https://github.com/coredns/coredns/pull/7737)
* plugin/cache: Remove superfluous allocations in item.toMsg (https://github.com/coredns/coredns/pull/7700)
* plugin/cache: Isolate metadata in prefetch goroutine (https://github.com/coredns/coredns/pull/7631)
* plugin/cache: Correct spelling of MaximumDefaultTTL in cache and dnsutil packages (https://github.com/coredns/coredns/pull/7678)
* plugin/dnstap: Better error handling (redial & logging) when Dnstap is busy (https://github.com/coredns/coredns/pull/7619)
* plugin/file: Performance finetuning (https://github.com/coredns/coredns/pull/7658)
* plugin/forward: Disallow NOERROR in failover (https://github.com/coredns/coredns/pull/7622)
* plugin/forward: Added support for per-nameserver TLS SNI (https://github.com/coredns/coredns/pull/7633)
* plugin/forward: Prevent busy loop on connection err (https://github.com/coredns/coredns/pull/7704)
* plugin/forward: Add max connect attempts knob (https://github.com/coredns/coredns/pull/7722)
* plugin/geoip: Add ASN schema support (https://github.com/coredns/coredns/pull/7730)
* plugin/geoip: Add support for subdivisions (https://github.com/coredns/coredns/pull/7728)
* plugin/kubernetes: Fix kubernetes plugin logging (https://github.com/coredns/coredns/pull/7727)
* plugin/multisocket: Cap num sockets to prevent OOM (https://github.com/coredns/coredns/pull/7615)
* plugin/nomad: Support service filtering (https://github.com/coredns/coredns/pull/7724)
* plugin/rewrite: Pre-compile CNAME rewrite regexp (https://github.com/coredns/coredns/pull/7697)
* plugin/secondary: Fix reload causing secondary plugin goroutine to leak (https://github.com/coredns/coredns/pull/7694)

### v1.13.1

- Date: 2025-10-08
- Version: v1.13.1
- Original notes: https://github.com/coredns/coredns/releases/tag/v1.13.1
- Permalink: https://whatsnew.fyi/product/coredns/releases/v1.13.1

- **changed** — Avoid string concatenation in loops in core
- **security** — Update golang to 1.25.2 and golang.org/x/net to v0.45.0 to address multiple high-severity CVEs
- **fixed** — Reject invalid UTF-8 tokens in sign plugin dbfile

This release updates CoreDNS to Go 1.25.2 and golang.org/x/net v0.45.0 to address multiple
high-severity CVEs. It also improves core performance by avoiding string concatenation in
loops, and hardens the sign plugin by rejecting invalid UTF-8 tokens in dbfile.

##### Brought to You By

Catena cyber
Ville Vesilehto
Yong Tang

##### Noteworthy Changes

* core: Avoid string concatenation in loops (https://github.com/coredns/coredns/pull/7572)
* core: Update golang to 1.25.2 and golang.org/x/net to v0.45.0 on CVE fixes (https://github.com/coredns/coredns/pull/7598)
* plugin/sign: Reject invalid UTF‑8 dbfile token (https://github.com/coredns/coredns/pull/7589)

### v1.13.0

- Date: 2025-10-06
- Version: v1.13.0
- Original notes: https://github.com/coredns/coredns/releases/tag/v1.13.0
- Permalink: https://whatsnew.fyi/product/coredns/releases/v1.13.0

- **added** — Add a Nomad plugin for integrating CoreDNS with HashiCorp Nomad
- **added** — Export timeout values in dnsserver.Server
- **added** — Add bounds for plugin args in dnstap plugin
- **changed** — Rely on dns.Server.ShutdownContext to gracefully stop
- **changed** — No failover to next upstream when receiving SERVFAIL or REFUSED response codes in forward plugin
- **fixed** — Fix Corefile infinite loop on unclosed braces
- **fixed** — Fix Corefile related import cycle issue
- **fixed** — Normalize panics on invalid origins
- **fixed** — Fix data race in tree Elem.Name in file plugin
- **fixed** — Enforce DNS message size limits in grpc plugin
- **fixed** — Prevent panic when ListenHosts is empty in loop plugin
- **fixed** — Avoid panic on invalid server block in loop plugin
- **fixed** — Prevent SIGTERM/reload deadlock in reload plugin

This release introduces a new Nomad plugin for integrating CoreDNS with HashiCorp Nomad.
It also fixes major Corefile issues on infinite loops and import cycles, improves shutdown
handling, normalizes core panics, addresses data races in the file plugin, enforces gRPC size
limits, adjusts forward failover behavior, as well as prevents reload deadlocks.

##### Brought to You By

Fitz_dev
Ilya Kulakov
Olli Janatuinen
Ville Vesilehto
Yong Tang

##### Noteworthy Changes

* core: Export timeout values in dnsserver.Server (https://github.com/coredns/coredns/pull/7497)
* core: Fix Corefile infinite loop on unclosed braces (https://github.com/coredns/coredns/pull/7571)
* core: Fix Corefile related import cycle issue (https://github.com/coredns/coredns/pull/7567)
* core: Normalize panics on invalid origins (https://github.com/coredns/coredns/pull/7563)
* core: Rely on dns.Server.ShutdownContext to gracefully stop (https://github.com/coredns/coredns/pull/7517)
* plugin/dnstap: Add bounds for plugin args (https://github.com/coredns/coredns/pull/7557)
* plugin/file: Fix data race in tree Elem.Name (https://github.com/coredns/coredns/pull/7574)
* plugin/forward: No failover to next upstream when receiving SERVFAIL or REFUSED response codes (https://github.com/coredns/coredns/pull/7458)
* plugin/grpc: Enforce DNS message size limits (https://github.com/coredns/coredns/pull/7490)
* plugin/loop: Prevent panic when ListenHosts is empty (https://github.com/coredns/coredns/pull/7565)
* plugin/loop: Avoid panic on invalid server block  (https://github.com/coredns/coredns/pull/7568)
* plugin/nomad: Add a Nomad plugin (https://github.com/coredns/coredns/pull/7467)
* plugin/reload: Prevent SIGTERM/reload deadlock (https://github.com/coredns/coredns/pull/7562)