CoreDNS

Profile

CoreDNS is a fast, flexible DNS server written in Go that chains plugins together to perform DNS functions, serving as the default DNS server for Kubernetes clusters since version 1.13. As a Cloud Native Computing Foundation graduated project, CoreDNS represents mature, production-ready infrastructure with governance vested in the CNCF community. Its plugin-based architecture enables organizations to compose sophisticated DNS resolution strategies by selecting and configuring appropriate plugins, addressing dynamic service discovery requirements that traditional DNS servers cannot accommodate. CoreDNS operates under Apache License 2.0, providing permissive open-source licensing suitable for both commercial and non-commercial deployments across containerized environments.

Focus

CoreDNS solves dynamic service discovery challenges in containerized applications by automatically updating DNS records as services appear and disappear within orchestration platforms. The plugin architecture enables unified DNS resolution across multiple backends simultaneously, bridging internal Kubernetes service discovery with external DNS queries to upstream providers. Platform engineers benefit from DNS-based service discovery without implementing custom application logic, reducing development complexity. Organizations with specialized DNS requirements can compose exact functionality through plugin selection rather than building custom solutions or compromising on requirements. CoreDNS addresses performance and scalability challenges inherent in resource-constrained containerized environments, using significantly less memory and CPU than traditional DNS servers while maintaining excellent throughput characteristics.

Background

CoreDNS was created in March 2016 by Miek Gieben, then a site reliability engineer at Google, to build a DNS server capable of communicating with multiple backends and overcoming limitations in traditional DNS servers like BIND. The project entered the Cloud Native Computing Foundation in February 2017, progressed to incubating status in February 2018, and achieved graduated status in January 2019 as the first CNCF graduate that year. Organizations including Bose, Hellofresh, Skyscanner, SoundCloud, and Zalando deploy CoreDNS in production environments. The project maintains active development through over one hundred contributors and sixteen maintainers, with governance distributed through CNCF community processes rather than single-organization control.

Main features

Plugin-based DNS processing architecture

CoreDNS implements a plugin chain architecture where each plugin performs specific DNS functions, with queries traveling sequentially through configured plugins in the Corefile. Approximately thirty built-in plugins provide functionality including Kubernetes service discovery, caching, forwarding, health checking, Prometheus metrics, DNSSEC signing, and zone file serving. Each plugin can generate responses directly, modify queries before passing them downstream, or decline handling to allow subsequent plugins to process requests. External plugins enable custom DNS logic for proprietary service discovery systems, database-backed records, or specialized routing policies without modifying CoreDNS core code, compiled into custom binaries through the build system.

Kubernetes-native service discovery integration

The kubernetes plugin provides deep integration with Kubernetes API servers, automatically discovering services, pods, and endpoints as they are created and destroyed within clusters. CoreDNS resolves service names to ClusterIP addresses, handles StatefulSet DNS records with stable names based on pod ordinals, and supports headless service DNS records pointing to individual pod IPs. The plugin manages cluster.local zones, reverse lookups through in-addr.arpa and ip6.arpa zones, and cross-namespace service resolution through fully qualified domain names. Pod applications receive DNS configuration automatically through kubelet-managed resolv.conf files, eliminating explicit configuration requirements while enabling NodeLocal DNSCache deployment for improved query latency.

Multi-protocol DNS with encryption support

CoreDNS supports four protocol schemes for DNS communication: traditional DNS over UDP/TCP, DNS over TLS (DoT) per RFC 7858, DNS over HTTPS (DoH) per RFC 8484, and DNS over gRPC for specialized implementations. Each protocol can be specified in the Corefile using scheme prefixes, enabling encrypted DNS queries that protect against eavesdropping and tampering. The forward plugin enables recursive resolution with configurable concurrent request limits, response caching durations, and server selection policies. Load balancing distributes responses across multiple backend servers, while DNSSEC support enables digital signing and validation protecting against spoofing attacks and ensuring data authenticity.