# CoreDNS v1.14.7

- Product: CoreDNS (https://whatsnew.fyi/product/coredns)
- Vendor: CNCF
- Date: 2026-08-19
- Version: v1.14.7
- Original notes: https://github.com/coredns/coredns/releases/tag/v1.14.7
- Permalink: https://whatsnew.fyi/product/coredns/releases/v1.14.7

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Add connection-level concurrency limiting to DNS-over-QUIC
- **added** — Add max conn limit to HTTPS/3
- **added** — Add prefer_positive stale policy to cache plugin
- **added** — Add support for topology-aware headless services via az-pinned subdomains in kubernetes plugin
- **added** — Support catalog migration and member scoping in secondary plugin
- **changed** — Bind cache responses and entries to QCLASS
- **changed** — Configure stale TTL and failure recheck in cache plugin
- **changed** — Make unsupported type fallthrough opt-in in hosts plugin
- **changed** — Pre-convert Origins to plugin.Zones in hosts plugin setup
- **changed** — Add HTTP/2 host/authority header and TO server resolution in forward plugin
- **changed** — Cap default connect attempts in forward plugin
- **changed** — Preserve AD when storing cache entries
- **changed** — Preserve monotonic time for TTL expiry in cache plugin
- **changed** — Normalize server block zones
- **fixed** — Fix autopath from bypassing ACL checks
- **fixed** — Fix blocked clients from receiving cached DNS answers
- **fixed** — Fix cache stale verification metadata race
- **fixed** — Do not cache SOA-less NODATA responses
- **fixed** — Do not expand wildcard across a closer empty non-terminal in file plugin
- **fixed** — Fix multi-primary AXFR zone contamination in file plugin
- **fixed** — Fix panic on zero-valued SOA refresh in file plugin
- **fixed** — Handle empty non-terminal wildcard sources in file plugin
- **fixed** — Resolve each additional section target only once in file plugin
- **fixed** — Return referrals after alias resolution in file plugin
- **fixed** — Run additional processing for CNAME/DNAME answers in file plugin
- **fixed** — Stop self-referential DNAME loops in file plugin
- **fixed** — Fix incorrect failover counter reset in forward plugin
- **fixed** — Fix incorrect retry of local DNS message serialization failures in forward plugin
- **fixed** — Fix DoH health checks to use configured CA instead of default TLS in forward plugin
- **fixed** — Fix UDP forwarding so malformed upstream datagram does not block valid ones
- **fixed** — Apply explicitly configured default policy in proxyproto plugin even when no allow list is present
- **fixed** — Normalize exact CNAME rewrite targets and preserve all records in rewrite plugin
- **fixed** — Preserve original request during rewrites in rewrite plugin
- **fixed** — Reset catalog members on ID change in secondary plugin
- **security** — Build with Go 1.26.6 to include fixes for CVE-2026-56865, CVE-2026-56864, and CVE-2026-33818

This release strengthens DNS caching, forwarding, and transport reliability, with
improved stale-cache behavior, safer upstream handling, and tighter connection
and overload controls. It also adds new capabilities for ACME-managed TLS,
topology-aware Kubernetes services, HTTP/2 forwarding, DNS-over-QUIC, and
secondary zone management, while delivering correctness and performance fixes
across file serving, rewrites, ACLs, hosts, transfers, and Kubernetes handling.
The release is built with Go 1.26.6 to include fixes for CVE-2026-56865,
CVE-2026-56864, and CVE-2026-33818.

##### Brought to You By

Baltasar Blanco
houyuwushang
Karan V
liucongran
llucas
Manuel Rüger
maximilize
Mehrdad Biukian
Michael Wolf
Ncesam
Nikolaus Schuetz
Nitin Nizhawan
Omkhar Arasaratnam
Pujitha Paladugu
rpb-ant
Saleh
Sueun Cho
Ville Vesilehto
Yash Singh
Yong Tang

##### Noteworthy Changes

core: Add connection-level concurrency limiting to DNS-over-QUIC (https://github.com/coredns/coredns/pull/8213)
core: Add max conn limit to https3 (https://github.com/coredns/coredns/pull/8187)
core: Document in-process embedding (https://github.com/coredns/coredns/pull/8436)
core: Make keylog path test portable (https://github.com/coredns/coredns/pull/8311)
core: Normalize server block zones (https://github.com/coredns/coredns/pull/8320)
core: Pin numeric uid/gid for the nonroot user (https://github.com/coredns/coredns/pull/8316)
plugin/acl: Fix autopath from bypassing acl checks (https://github.com/coredns/coredns/pull/8290)
plugin/acl: Fix blocked clients from receiving cached DNS answers (https://github.com/coredns/coredns/pull/8289)
plugin/auto: Fix inverted arguments in duplicate-origin warning (https://github.com/coredns/coredns/pull/8317)
plugin/cache: Add prefer_positive stale policy (https://github.com/coredns/coredns/pull/8378)
plugin/cache: Bind responses and entries to QCLASS (https://github.com/coredns/coredns/pull/8272)
plugin/cache: Configure stale TTL and failure recheck (https://github.com/coredns/coredns/pull/8411)
plugin/cache: Do not cache SOA-less NODATA responses (https://github.com/coredns/coredns/pull/8232)
plugin/cache: Fix cache stale verification metadata race (https://github.com/coredns/coredns/pull/8366)
plugin/cache: Preserve AD when storing cache entries (https://github.com/coredns/coredns/pull/8438)
plugin/cache: Preserve monotonic time for TTL expiry (https://github.com/coredns/coredns/pull/8346)
plugin/file: Do not expand wildcard across a closer empty non-terminal (https://github.com/coredns/coredns/pull/8223)
plugin/file: Fixes multi-primary AXFR zone contamination (https://github.com/coredns/coredns/pull/8367)
plugin/file: Fix panic on zero-valued SOA refresh (https://github.com/coredns/coredns/pull/8276)
plugin/file: Handle empty non-terminal wildcard sources (https://github.com/coredns/coredns/pull/8386)
plugin/file: Resolve each additional section target only once (https://github.com/coredns/coredns/pull/8286)
plugin/file: Return referrals after alias resolution (https://github.com/coredns/coredns/pull/8341)
plugin/file: Run additional processing for CNAME/DNAME answers (https://github.com/coredns/coredns/pull/8337)
plugin/file: Stop self-referential DNAME loops (https://github.com/coredns/coredns/pull/8418)
plugin/forward: Add http(2) host/authority header and TO server resolution (https://github.com/coredns/coredns/pull/8233)
plugin/forward: Cap default connect attempts (https://github.com/coredns/coredns/pull/8365)
plugin/forward: Fast-path string comparison in isAllowedDomain (https://github.com/coredns/coredns/pull/8385)
plugin/forward: Fix incorrect failover counter reset (https://github.com/coredns/coredns/pull/8277)
plugin/forward: Fix incorrect retry of local DNS message serialization failures (https://github.com/coredns/coredns/pull/8313)
plugin/forward: Fix issue in DoH health checks used a default TLS instead of the configured CA (https://github.com/coredn

_[Truncated at 4000 characters — full notes: https://github.com/coredns/coredns/releases/tag/v1.14.7]_