Skip to content

CoreDNS

v1.14.4 Feature

This release adds 5 notable features for engineering teams evaluating rollout.

Published 1mo DNS & Service Discovery
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

cncf coredns dns go plugin service-discovery

Affected surfaces

crypto_tls

Summary

AI summary

Broad release touches Noteworthy Changes, core, plugin/cache, and plugin/file.

Changes in this release

Feature Medium

Signs each RRset with the owning zone's DNSSEC key

Signs each RRset with the owning zone's DNSSEC key

Source: granite4.1:30b@2026-06-09-audit

Confidence: low

 —
Feature Medium

Forwards NODATA responses to the next handler in forward plugin

Forwards NODATA responses to the next handler in forward plugin

Source: granite4.1:30b@2026-06-09-audit

Confidence: low

 —
Feature Low

Adds loong64 architecture support

Adds loong64 architecture support

Source: llm_adapter@2026-06-09

Confidence: high

 —
Feature Low

Bounds HTTP/3 request header size for DoH3

Bounds HTTP/3 request header size for DoH3

Source: llm_adapter@2026-06-09

Confidence: high

 —
Feature Low

Exposes TLS ConnectionState (SNI) for DoQ

Exposes TLS ConnectionState (SNI) for DoQ

Source: llm_adapter@2026-06-09

Confidence: high

 —
Feature Low

Uses http.LocalAddrContextKey for DoH local address

Uses http.LocalAddrContextKey for DoH local address

Source: llm_adapter@2026-06-09

Confidence: high

 —
Feature Low

Applies `access` mode to every zone in the same block for Azure plugin

Applies `access` mode to every zone in the same block for Azure plugin

Source: llm_adapter@2026-06-09

Confidence: high

 —
Feature Low

Adds optional verify timeout to serve_stale in cache plugin

Adds optional verify timeout to serve_stale in cache plugin

Source: llm_adapter@2026-06-09

Confidence: high

 —
Feature Low

Allows cache TTLs above default 3600 seconds in cache plugin

Allows cache TTLs above default 3600 seconds in cache plugin

Source: llm_adapter@2026-06-09

Confidence: high

 —
Feature Low

Prefer positive cache over SERVFAIL in ncache for cache plugin

Prefer positive cache over SERVFAIL in ncache for cache plugin

Source: granite4.1:30b@2026-06-09-audit

Confidence: low

 —
Feature Low

Adds incoming connection support for dnstap plugin

Adds incoming connection support for dnstap plugin

Source: granite4.1:30b@2026-06-09-audit

Confidence: low

 —
Feature Low

Triggers zone reloads based on modification time for file plugin

Triggers zone reloads based on modification time for file plugin

Source: granite4.1:30b@2026-06-09-audit

Confidence: low

 —
Feature Low

Adds hostname resolution support for forward targets in forward plugin

Adds hostname resolution support for forward targets in forward plugin

Source: granite4.1:30b@2026-06-09-audit

Confidence: low

 —
Feature Low

Adds fallthrough support to secondary plugin

Adds fallthrough support to secondary plugin

Source: granite4.1:30b@2026-06-09-audit

Confidence: low

 —
Bugfix Medium

Removes duplicate cipher suites from core

Removes duplicate cipher suites from core

Source: llm_adapter@2026-06-09

Confidence: high

 —
Bugfix Medium

Removes debug fmt.Println from multicluster zone validation in kubernetes plugin

Removes debug fmt.Println from multicluster zone validation in kubernetes plugin

Source: llm_adapter@2026-06-09

Confidence: high

 —
Bugfix Medium

Rejects invalid any and local config in any plugin

Rejects invalid any and local config in any plugin

Source: llm_adapter@2026-06-09

Confidence: high

 —
Bugfix Medium

Prevents nil pointer dereference when dropping malformed PROXY packets in proxyproto plugin

Prevents nil pointer dereference when dropping malformed PROXY packets in proxyproto plugin

Source: granite4.1:30b@2026-06-09-audit

Confidence: low

 —
Bugfix Low

Rejects unknown chaos block options in chaos plugin

Rejects unknown chaos block options in chaos plugin

Source: granite4.1:30b@2026-06-09-audit

Confidence: low

 —
Bugfix Low

Canonicalizes escape form in owner names for file plugin

Canonicalizes escape form in owner names for file plugin

Source: granite4.1:30b@2026-06-09-audit

Confidence: low

 —
Bugfix Low

Uses descriptive errors for unknown block options in health and log plugins

Uses descriptive errors for unknown block options in health and log plugins

Source: granite4.1:30b@2026-06-09-audit

Confidence: low

 —
Bugfix Low

Rejects unknown ready plugin properties

Rejects unknown ready plugin properties

Source: granite4.1:30b@2026-06-09-audit

Confidence: low

 —
Bugfix Low

Rejects unknown trace and dnstap block options in trace plugin

Rejects unknown trace and dnstap block options in trace plugin

Source: granite4.1:30b@2026-06-09-audit

Confidence: low

 —
Full changelog

This release improves transport security and operational flexibility, with
enhancements for DoH3 and DoQ, improved DNSSEC signing behavior, and support for
the loong64 architecture. It also adds configurable cache verification, hostname
resolution for forward targets, incoming connection support for dnstap, fallthrough
support in the secondary plugin, automatic zone reloads, and improved forwarding
behavior for NODATA responses.

Brought to You By

Cedric Wang
Charlie Tonneslan
Dmytro Alieksieiev
Endre Szabo
Immanuel Tikhonov
Isolus
James R T
JUN YANG
Jöran Malek
Nicholas Amorim
Syed Azeez
Umut Polat
Ville Vesilehto
weiguozhang
Yong Tang
徐晓伟

Noteworthy Changes

  • core: Add loong64 arch support (https://github.com/coredns/coredns/pull/8137)
  • core: Bound HTTP/3 request header size for DoH3 (https://github.com/coredns/coredns/pull/8135)
  • core: Expose TLS ConnectionState (SNI) for DoQ (https://github.com/coredns/coredns/pull/8129)
  • core: Remove duplicate cipher suites (https://github.com/coredns/coredns/pull/8118)
  • core: Use http.LocalAddrContextKey for DoH local address (https://github.com/coredns/coredns/pull/8149)
  • plgin/kubernetes: Remove debug fmt.Println from multicluster zone validation (https://github.com/coredns/coredns/pull/8131)
  • plugin/any: Reject invalid any and local config (https://github.com/coredns/coredns/pull/8133)
  • plugin/azure: Apply access mode to every zone in the same block (https://github.com/coredns/coredns/pull/8110)
  • plugin/cache: Add optional verify timeout to serve_stale (https://github.com/coredns/coredns/pull/8070)
  • plugin/cache: Allow cache TTLs above default 3600s (https://github.com/coredns/coredns/pull/8134)
  • plugin/cache: Prefer positive cache over SERVFAIL in ncache (https://github.com/coredns/coredns/pull/8003)
  • plugin/chaos: Reject unknown chaos block options (https://github.com/coredns/coredns/pull/8121)
  • plugin/dnssec: Sign each RRset with the zone that owns its name, not the query zone (https://github.com/coredns/coredns/pull/8138)
  • plugin/dnstap: Feature: Added incoming connection support (https://github.com/coredns/coredns/pull/8086)
  • plugin/file: Canonicalize escape form in owner names (https://github.com/coredns/coredns/pull/8109)
  • plugin/file: Trigger reload of zones based on mtime (https://github.com/coredns/coredns/pull/8085)
  • plugin/forward: Add hostname resolution support for TO endpoints (https://github.com/coredns/coredns/pull/5646) (https://github.com/coredns/coredns/pull/7923)
  • plugin/forward: Forward NODATA responses to Next handler (https://github.com/coredns/coredns/pull/8065)
  • plugin/health: Use descriptive error for unknown block options in health and log plugins (https://github.com/coredns/coredns/pull/8128)
  • plugin/ready: Reject unknown ready plugin properties (https://github.com/coredns/coredns/pull/8119)
  • plugin/proxyproto: Prevent nil pointer dereference when dropping malformed PROXY packets (https://github.com/coredns/coredns/pull/8154)
  • plugin/secondary: Add fallthrough support (https://github.com/coredns/coredns/pull/8041)
  • plugin/trace: Reject unknown trace and dnstap block options (https://github.com/coredns/coredns/pull/8120)
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track CoreDNS

Get notified when new releases ship.

Sign up free

About CoreDNS

CoreDNS is a DNS server that chains plugins

All releases →

Related context

Related tools

Beta — feedback welcome: [email protected]