RATATOSKRATATOSK
Sign in

CoreDNS

v1.15.0Kubernetes Core
Oct 21, 2026

ACTION 1CHECK 2OTHER 63

This release adds DNS and plugin capabilities while changing validation and runtime behavior. It also includes correctness, reliability, and security fixes, including an updated Go toolchain.

Action needed (1)

Check if affected (2)

  • breakingConflicting TLS policies on shared listeners

    Applies if you configure TLS policies and shared listeners.

    The core now rejects conflicting TLS policies on shared listeners.

    coredns#8565

  • breakingNon-final TSIG records rejected by plugin/tsig

    Applies if you use plugin/tsig.

    plugin/tsig now rejects non-final TSIG records.

    coredns#8585

All 63 other recorded changesfixes 30 · additions 17 · value changes 11 · constraints 5

fixes (30)

  • core: Cancel only the stalled DoQ stream, not the whole DoQ connection (https://github.com/coredns/coredns/pull/8567)
  • core: Fix DataDog library dependency issue (https://github.com/coredns/coredns/pull/8541)
  • core: Stop echoing unhandled EDNS options (https://github.com/coredns/coredns/pull/8514)
  • plugin/autopath: Fixes a nil pointer dereference panic in autopath during search path walk (https://github.com/coredns/coredns/pull/8517)
  • plugin/cache: Don't cache or panic on responses with no question (https://github.com/coredns/coredns/pull/8467)
  • plugin/cache: Fix timed stale caused refreshes (https://github.com/coredns/coredns/pull/8587)
  • plugin/cache: Prevents a nil pointer dereference panic in the cache prefetch (https://github.com/coredns/coredns/pull/8512)
  • plugin/dns64: Fixes a nil pointer dereference panic in dns64 during response (https://github.com/coredns/coredns/pull/8511)
  • plugin/dns64: Preserve A fallback response codes (https://github.com/coredns/coredns/pull/8619)
  • plugin/dns64: Reject unsupported prefix lengths (https://github.com/coredns/coredns/pull/8611)
  • plugin/etcd: Avoid apex fallback on backend errors (https://github.com/coredns/coredns/pull/8465)
  • plugin/etcd: Fix etcd library update issue (https://github.com/coredns/coredns/pull/8542)
  • plugin/etcd: Stop target stripping at the end of a name (https://github.com/coredns/coredns/pull/8584)
  • plugin/file: Fix less is not up to RFC 1034 and 4034 (https://github.com/coredns/coredns/pull/8503)
  • plugin/file: Fix race condition in file plugin closer (https://github.com/coredns/coredns/pull/8583)
  • plugin/file: Reject SOA owners that do not match the zone (https://github.com/coredns/coredns/pull/8555)
  • plugin/file: Return SERVFAIL on self-referential CNAME loops (https://github.com/coredns/coredns/pull/8475)
  • plugin/forward: Ensure forward sets the DoH host (https://github.com/coredns/coredns/pull/8470)
  • plugin/grpc: Close clients on shutdown (https://github.com/coredns/coredns/pull/8582)
  • plugin/hosts: Don't drop entries after an over-long line (https://github.com/coredns/coredns/pull/8496)
  • plugin/hosts: Don't drop over-long fields silently (https://github.com/coredns/coredns/pull/8551)
  • plugin/k8s_external: Fixes a nil pointer dereference panic when upstream lookup returns no response (https://github.com/coredns/coredns/pull/8518)
  • plugin/loadbalance: Validate the response before dereferencing it in WriteMsg (https://github.com/coredns/coredns/pull/8523)
  • plugin/metrics: Release listener on TLS startup failure (https://github.com/coredns/coredns/pull/8527)
  • plugin/minimal: Fixes a nil pointer dereference panic in minimal prefetch response processing (https://github.com/coredns/coredns/pull/8506)
  • plugin/ready: Release lock before server shutdown (https://github.com/coredns/coredns/pull/8526)
  • plugin/reload: Broadcast shutdown signal (https://github.com/coredns/coredns/pull/8504)
  • plugin/rewrite: Fixes a nil pointer dereference panic in ResponseReverter.WriteMsg (https://github.com/coredns/coredns/pull/8519)
  • plugin/trace: Recognize Zipkin URL schemes by prefix (https://github.com/coredns/coredns/pull/8625)
  • plugin/trace: Return error from Zipkin NewEndpoint in trace setup (https://github.com/coredns/coredns/pull/8577)

additions (17)

  • core: Add opt-in JSON logging with structured DNS query fields (https://github.com/coredns/coredns/pull/8553)
  • core: Add opt-in opcode admission (https://github.com/coredns/coredns/pull/8469)
  • core: Support explicit registration for embedded hosts (https://github.com/coredns/coredns/pull/8525)
  • plugin/azure: Add refresh directive (https://github.com/coredns/coredns/pull/8614)
  • plugin/clouddns: Add endpoint directive (https://github.com/coredns/coredns/pull/8618)
  • plugin/clouddns: Add refresh directive (https://github.com/coredns/coredns/pull/8616)
  • plugin/dnstap: Tap deferred error responses (https://github.com/coredns/coredns/pull/8549)
  • plugin/dynupdate: Add durable authenticated RFC 2136 updates (https://github.com/coredns/coredns/pull/8520)
  • plugin/etcd: Allow disabling legacy apex fallback (https://github.com/coredns/coredns/pull/8468)
  • plugin/file: Track zone mtime for reload_by_mtime (https://github.com/coredns/coredns/pull/8556)
  • plugin/forward: Support DNS-over-QUIC upstreams (https://github.com/coredns/coredns/pull/8474)
  • plugin/https: Add max_streams to limit HTTP/2 concurrent streams (https://github.com/coredns/coredns/pull/8522)
  • plugin/proxyproto: Expose PPv2 TLVs to downstream plugins as metadata (https://github.com/coredns/coredns/pull/8641)
  • plugin/quic: Add max_connections directive (https://github.com/coredns/coredns/pull/8610)
  • plugin/rewrite: Support opt-in metadata in regex name replacements (https://github.com/coredns/coredns/pull/8665)
  • plugin/template: Add expr-lang support to templates (https://github.com/coredns/coredns/pull/8450)
  • plugin/tsig: Expose validated TSIG key identity (https://github.com/coredns/coredns/pull/8471)

value changes (11)

  • core: Use Zones.Contains when any match suffices (https://github.com/coredns/coredns/pull/8505)
  • plugin/cache: Cache SERVFAIL when the resolver fails without a response (https://github.com/coredns/coredns/pull/8629)
  • plugin/cache: Stop setting AA on answers served from cache (https://github.com/coredns/coredns/pull/8419)
  • plugin/forward: Bound DoT connection setup for retries (https://github.com/coredns/coredns/pull/8543)
  • plugin/forward: Set IP_RECVERR on upstream UDP sockets (https://github.com/coredns/coredns/pull/8628)
  • plugin/forward: Treat forward upstream hostnames as absolute FQDNs to avoid search-domain resolution. (https://github.com/coredns/coredns/pull/8563)
  • plugin/kubernetes: Include structured key/value context in client-go logs (https://github.com/coredns/coredns/pull/8490)
  • plugin/loadbalance: Reduce roundRobin allocations for homogeneous address sets (https://github.com/coredns/coredns/pull/8375)
  • plugin/metrics: Drop the nonexistent type label from request_duration_seconds (https://github.com/coredns/coredns/pull/8650)
  • plugin/proxyproto: Preserve the UDP peer for LOCAL (https://github.com/coredns/coredns/pull/8581)
  • plugin/siit: Add initial SIIT implementation (https://github.com/coredns/coredns/pull/8188)

constraints (5)

  • core: Make TsigSecret public (https://github.com/coredns/coredns/pull/8434)
  • plugin/azure: Allow startup with unavailable zones (https://github.com/coredns/coredns/pull/8524)
  • plugin/grpc_server: Both limits accept zero, not only positive integers (https://github.com/coredns/coredns/pull/8660)
  • plugin/kubernetes: Support pods with multiple IPs (https://github.com/coredns/coredns/pull/8635)
  • plugin/rewrite: Limit rewrite cname recursion (https://github.com/coredns/coredns/pull/8570)
Add CoreDNS to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →
Official release note ↗All CoreDNS releases →