CoreDNS

Related articles
Domain name resolution
CoreDNS
is a DNS server/forwarder, written in Go, that chains plugins. Each plugin performs a (DNS) function making it very flexible. If some functionality is not provided out of the box you can add it by writing a plugin.
CoreDNS can listen for DNS requests coming in over UDP/TCP (Do53),
DNS over TLS
(DoT,
RFC 7858
) and
DNS over HTTPS
(DoH,
RFC 8484
).
Installation
Install
the
coredns
AUR
package.
Configuration
See
the documentation
on configuration.
coredns.service
will look for
/etc/coredns/Corefile
and fail to start if the file is missing. After creating the configuration file in that location,
Start/enable
coredns.service
.
Below is an example configuration with useful plugins. CoreDNS will start on port
53
, serve DNS to the listed subnets and forward everything to Wikimedia DNS servers. You can use
drill
command to verify that CoreDNS is working locally:
drill archlinux.org @127.0.0.1
.
/etc/coredns/Corefile
.:53 {
       bind 127.0.0.1 ::1 192.168.1.254 192.0.0.1 
       bufsize 1232 
       acl { 
               allow net 192.168.0.0/16 172.16.0.0/12 10.0.0.0/8 192.0.0.0/24
               block
       }
       hosts { 
               reload 0
               fallthrough
       }
       loadbalance
       forward . tls://185.71.138.138 tls://2001:67c:930::1 {
               tls_servername wikimedia-dns.org
       }
       cache {
               success 4096
               denial  1024
               prefetch 512
       }
       prometheus :9153
       errors
       log
}
Note
This example uses Wikimedia DNS. Replace it with a DNS resolver you trust. See
Domain name resolution#Third-party DNS services
.
Forwarding
To forward queries to a different resolver, use the
forward plugin
. It supports regular DNS and DNS over TLS. For DNS over TLS, use the
tls://
protocol and specify the server hostname with
tls_servername
.
For example, to forward everything using DNS over TLS to Wikimedia DNS, edit
/etc/coredns/Corefile
as follows:
/etc/coredns/Corefile
.:53 {
    bind 127.0.0.1 ::1
    forward . tls://185.71.138.138 tls://2001:67c:930::1 {
        tls_servername wikimedia-dns.org
    }
}
Note
This example uses Wikimedia DNS. Replace it with a DNS resolver you trust. See
Domain name resolution#Third-party DNS services
.
Configure
127.0.0.1
and
::1
as your nameserver; see
Domain name resolution
.
Restart
coredns.service
after that.
Run
journalctl -u coredns
as root to verify things are working by default. The resolver will now listen on port
53
.
If the resolver should be accessible from other hosts, configure other network interfaces or IP addresses in
/etc/coredns/Corefile
with
bind
. Also the
acl plugin
can be used to block ranges that should be use the server for recursion. Refer to
CoreDNS plugin documentation
for more information.
Warning
Unless you specifically want to run an open DNS resolver, do not configure the resolver to listen on public (internet-facing) IP addresses or all IP addresses (
0.0.0.0
and
::
).
If the resolver should respect entries from the
/etc/hosts
file, add a
hosts
line to
/etc/coredns/Corefile
. See
coredns-hosts(7)
.
See also
coredns(1)
CoreDNS manual
CoreDNS plugins
CoreDNS github