# CoreDNS v1.14.4

- Product: CoreDNS (https://whatsnew.fyi/product/coredns)
- Vendor: CNCF
- Date: 2026-06-09
- Version: v1.14.4
- Original notes: https://github.com/coredns/coredns/releases/tag/v1.14.4
- Permalink: https://whatsnew.fyi/product/coredns/releases/v1.14.4

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Add loong64 architecture support
- **added** — Add optional verify timeout to serve_stale in cache plugin
- **added** — Add hostname resolution support for TO endpoints in forward plugin
- **added** — Add incoming connection support in dnstap plugin
- **added** — Add fallthrough support in secondary plugin
- **changed** — Allow cache TTLs above default 3600s
- **changed** — Bound HTTP/3 request header size for DoH3
- **changed** — Expose TLS ConnectionState (SNI) for DoQ
- **changed** — Use http.LocalAddrContextKey for DoH local address
- **changed** — Apply access mode to every zone in the same block in azure plugin
- **changed** — Prefer positive cache over SERVFAIL in ncache
- **changed** — Sign each RRset with the zone that owns its name, not the query zone in dnssec plugin
- **changed** — Trigger reload of zones based on mtime in file plugin
- **changed** — Forward NODATA responses to Next handler in forward plugin
- **fixed** — Remove duplicate cipher suites
- **fixed** — Remove debug fmt.Println from multicluster zone validation in kubernetes plugin
- **fixed** — Canonicalize escape form in owner names in file plugin
- **fixed** — Prevent nil pointer dereference when dropping malformed PROXY packets in proxyproto plugin
- **removed** — Reject invalid any and local config in any plugin
- **removed** — Reject unknown chaos block options in chaos plugin

This release improves transport security and operational flexibility, with
enhancements for DoH3 and DoQ, improved DNSSEC signing behavior, and support for
the loong64 architecture. It also adds configurable cache verification, hostname
resolution for forward targets, incoming connection support for dnstap, fallthrough
support in the secondary plugin, automatic zone reloads, and improved forwarding
behavior for NODATA responses.

##### Brought to You By

Cedric Wang
Charlie Tonneslan
Dmytro Alieksieiev
Endre Szabo
Immanuel Tikhonov
Isolus
James R T
JUN YANG
Jöran Malek
Nicholas Amorim
Syed Azeez
Umut Polat
Ville Vesilehto
weiguozhang
Yong Tang
徐晓伟

##### Noteworthy Changes

* core: Add loong64 arch support (https://github.com/coredns/coredns/pull/8137)
* core: Bound HTTP/3 request header size for DoH3 (https://github.com/coredns/coredns/pull/8135)
* core: Expose TLS ConnectionState (SNI) for DoQ (https://github.com/coredns/coredns/pull/8129)
* core: Remove duplicate cipher suites (https://github.com/coredns/coredns/pull/8118)
* core: Use http.LocalAddrContextKey for DoH local address (https://github.com/coredns/coredns/pull/8149)
* plgin/kubernetes: Remove debug fmt.Println from multicluster zone validation (https://github.com/coredns/coredns/pull/8131)
* plugin/any: Reject invalid any and local config (https://github.com/coredns/coredns/pull/8133)
* plugin/azure: Apply `access` mode to every zone in the same block (https://github.com/coredns/coredns/pull/8110)
* plugin/cache: Add optional verify timeout to serve_stale (https://github.com/coredns/coredns/pull/8070)
* plugin/cache: Allow cache TTLs above default 3600s (https://github.com/coredns/coredns/pull/8134)
* plugin/cache: Prefer positive cache over SERVFAIL in ncache (https://github.com/coredns/coredns/pull/8003)
* plugin/chaos: Reject unknown chaos block options (https://github.com/coredns/coredns/pull/8121)
* plugin/dnssec: Sign each RRset with the zone that owns its name, not the query zone (https://github.com/coredns/coredns/pull/8138)
* plugin/dnstap: Feature: Added incoming connection support (https://github.com/coredns/coredns/pull/8086)
* plugin/file: Canonicalize escape form in owner names (https://github.com/coredns/coredns/pull/8109)
* plugin/file: Trigger reload of zones based on mtime (https://github.com/coredns/coredns/pull/8085)
* plugin/forward: Add hostname resolution support for TO endpoints (https://github.com/coredns/coredns/pull/5646) (https://github.com/coredns/coredns/pull/7923)
* plugin/forward: Forward NODATA responses to Next handler (https://github.com/coredns/coredns/pull/8065)
* plugin/health: Use descriptive error for unknown block options in health and log plugins (https://github.com/coredns/coredns/pull/8128)
* plugin/ready: Reject unknown ready plugin properties (https://github.com/coredns/coredns/pull/8119)
* plugin/proxyproto: Prevent nil pointer dereference when dropping malformed PROXY packets (https://github.com/coredns/coredns/pull/8154)
* plugin/secondary: Add fallthrough support (https://github.com/coredns/coredns/pull/8041)
* plugin/trace: Reject unknown trace and dnstap block options (https://github.com/coredns/coredns/pull/8120)