coredns v1.14.3 版本更新介绍

发布日期: 2026-04-22
版本号: v1.14.3

此次CoreDNS更新引入了Windows服务支持，并在DoH、DoH3、QUIC和gRPC传输协议上实现了完整的TSIG验证，同时改进了TSIG传播与DoH请求验证。metrics端点现支持可选的TLS。性能与稳定性通过缓存预取、QUIC优化及forward插件新增的max_age选项得到提升。其他更新包括增强了SVCB/HTTPS支持、改进区域传输行为，以及多项DNSSEC、PROXY协议和并发处理的修复。该版本基于Go 1.26.2构建，该版本包含针对多个CVE的安全修复。

更新内容 （中文）

本次发布新增了Windows服务支持，实现了跨DoH、DoH3、QUIC和gRPC传输的完整TSIG验证，并改进了TSIG传播机制与DoH请求验证流程。同时为指标端点增加了可选的TLS支持。通过缓存预取、QUIC优化及转发插件新增的max_age选项，提升了性能与稳定性。其他更新包括增强SVCB/HTTPS支持、改进区域传输行为，以及针对DNSSEC、PROXY协议和并发问题的多项修复。此版本基于Go 1.26.2构建，包含针对CVE-2026-32282、CVE-2026-32289、CVE-2026-33810、CVE-2026-27144、CVE-2026-27143、CVE-2026-32288、CVE-2026-32283及CVE-2026-27140的安全修复，并包含CVE-2026-32936、CVE-2026-33190、CVE-2026-33489、CVE-2026-32934和CVE-2026-35579的修复。

由以下贡献者提供支持

andreyrusanov-ec cangming Cedric Wang Ilya Kulakov Ingmar Van Glabbeek John-Michael Mulesa JUN YANG liucongran Minghang Chen Peppi-Lotta rpb-ant Seena Fallah Syed Azeez Umut Polat Ville Vesilehto Yong Tang

值得关注的更改

• 核心：在DoH传输中添加完整TSIG验证 (https://github.com/coredns/coredns/pull/8013)
• 核心：在DoH3传输中添加完整TSIG验证 (https://github.com/coredns/coredns/pull/8044)
• 核心：在QUIC传输中添加完整TSIG验证 (ttps://github.com/coredns/coredns/pull/8007)
• 核心：在gRPC传输中添加完整TSIG验证 (https://github.com/coredns/coredns/pull/8006)
• 核心：支持将CoreDNS作为Windows服务运行 (https://github.com/coredns/coredns/pull/7962)
• 核心：当QUIC工作线程池已满时避免生成等待协程 (https://github.com/coredns/coredns/pull/7927)
• 核心：在gRPC传输中保留TSIG状态 (https://github.com/coredns/coredns/pull/7943)
• 核心：向DoT服务器传播TSIG密钥 (https://github.com/coredns/coredns/pull/7928)
• 核心：在DoQ传输中传播TSIG状态 (https://github.com/coredns/coredns/pull/7947)
• 核心：拒绝过大的DoH GET dns查询参数 (https://github.com/coredns/coredns/pull/7926)
• 核心：为PROXY协议使用每连接的本地地址 (https://github.com/coredns/coredns/pull/8005)
• 插件/auto：在遍历前解析符号链接目录 (https://github.com/coredns/coredns/pull/8032)
• 插件/cache：为singleflight预取添加atomic.Bool (https://github.com/coredns/coredns/pull/7963)
• 插件/cache：预取时不保持客户端连接 (https://github.com/coredns/coredns/pull/7944)
• 插件/dnssec：添加防御性空值检查 (https://github.com/coredns/coredns/pull/7997)
• 插件/dnssec：避免缓存空的签名结果 (https://github.com/coredns/coredns/pull/7996)
• 插件/dnssec：ParseKeyFile在错误时返回nil (https://github.com/coredns/coredns/pull/8000)
• 插件/dnssec：签名错误时返回nil签名 (https://github.com/coredns/coredns/pull/7999)
• 插件/dnsserver：允许视图服务器块以任意声明顺序出现 (https://github.com/coredns/coredns/pull/8001)
• 插件/file：扩展SVCB/HTTPS记录支持 (https://github.com/coredns/coredns/pull/7950)
• 插件/file：修复xfr.go中的数据竞争 (https://github.com/coredns/coredns/pull/8039)
• 插件/file：为区域数据引入snapshot()/setData()访问器 (https://github.com/coredns/coredns/pull/8040)
• 插件/file：使用互斥锁保护Zone.Expired (https://github.com/coredns/coredns/pull/7940)
• 插件/forward：添加max_age选项以强制执行绝对连接生存时间 (https://github.com/coredns/coredns/pull/7903)
• 插件/kubernetes：在dns_programming_duration指标中记录cluster_ip服务 (https://github.com/coredns/coredns/pull/7951)
• 插件/kubernetes：清理指标中的非UTF-8主机 (https://github.com/coredns/coredns/pull/7998)
• 插件/metrics：为/metrics端点添加可选的TLS支持 (https://github.com/coredns/coredns/pull/7255)
• 插件/metrics：允许选择性导出所有Go运行时指标 (https://github.com/coredns/coredns/pull/7990)
• 插件/ready：修复就绪插件的重置列表 (https://github.com/coredns/coredns/pull/8035)
• 插件/secondary：区域传输后发送NOTIFY消息 (https://github.com/coredns/coredns/pull/7901)
• 插件/tls：添加keylog选项以配置TLSConfig.KeyLogWriter (https://github.com/coredns/coredns/pull/7537)
• 插件/tls：为密钥日志测试路径使用临时目录 (https://github.com/coredns/coredns/pull/8010)
• 插件/transfer：按消息大小而非数量批量处理AXFR记录 (https://github.com/coredns/coredns/pull/8002)
• 插件/transfer：修复AXFR/IXFR的大小写敏感区域处理 (https://github.com/coredns/coredns/pull/7899)
• 插件/transfter：修复longestMatch以正确选择最具体的区域 (https://github.com/coredns/coredns/pull/7949)
• 插件/tsig：添加基于操作码的TSIG的require_opcode指令 (https://github.com/coredns/coredns/pull/7828)
• proxyproto：为Cloudflare Spectrum PPv2添加UDP会话跟踪 (https://github.com/coredns/coredns/pull/7967)

更新内容 （原始）

This release introduces Windows service support, along with full TSIG verification across DoH, DoH3, QUIC, and gRPC transports, and improved TSIG propagation and DoH request validation. It also adds optional TLS for the metrics endpoint. Performance and stability are improved through cache prefetching, QUIC optimizations, and a new max_age option in the forward plugin. Additional updates include enhanced SVCB/HTTPS support, improved zone transfer behavior, and various DNSSEC, PROXY protocol, and concurrency fixes. The release is built with Go 1.26.2, which includes security fixes addressing CVE-2026-32282, CVE-2026-32289, CVE-2026-33810, CVE-2026-27144, CVE-2026-27143, CVE-2026-32288, CVE-2026-32283, and CVE-2026-27140, and also includes fixes for CVE-2026-32936, CVE-2026-33190, CVE-2026-33489, CVE-2026-32934, and CVE-2026-35579.

Brought to You By

andreyrusanov-ec cangming Cedric Wang Ilya Kulakov Ingmar Van Glabbeek John-Michael Mulesa JUN YANG liucongran Minghang Chen Peppi-Lotta rpb-ant Seena Fallah Syed Azeez Umut Polat Ville Vesilehto Yong Tang

Noteworthy Changes

• core: Add full TSIG verification in DoH transport (https://github.com/coredns/coredns/pull/8013)
• core: Add full TSIG verification in DoH3 transport (https://github.com/coredns/coredns/pull/8044)
• core: Add full TSIG verification in QUIC transport (ttps://github.com/coredns/coredns/pull/8007)
• core: Add full TSIG verification in gRPC transport (https://github.com/coredns/coredns/pull/8006)
• core: Add support for running CoreDNS as a Windows service (https://github.com/coredns/coredns/pull/7962)
• core: Avoid spawning waiter goroutines when QUIC worker pool is full (https://github.com/coredns/coredns/pull/7927)
• core: Preserve TSIG status in gRPC transport (https://github.com/coredns/coredns/pull/7943)
• core: Propagate TSIG secrets to DoT server (https://github.com/coredns/coredns/pull/7928)
• core: Propagate TSIG status in DoQ transport (https://github.com/coredns/coredns/pull/7947)
• core: Reject oversized GET dns query parameter of DoH (https://github.com/coredns/coredns/pull/7926)
• core: Use per-connection local address for PROXY protocol (https://github.com/coredns/coredns/pull/8005)
• plugin/auto: Resolve symlinked directory before walk (https://github.com/coredns/coredns/pull/8032)
• plugin/cache: Add an atomic.Bool to singleflight prefetching (https://github.com/coredns/coredns/pull/7963)
• plugin/cache: Prefetch without holding a client connection (https://github.com/coredns/coredns/pull/7944)
• plugin/dnssec: Add defensive nil checks (https://github.com/coredns/coredns/pull/7997)
• plugin/dnssec: Avoid caching empty signing results (https://github.com/coredns/coredns/pull/7996)
• plugin/dnssec: Return nil from ParseKeyFile on error (https://github.com/coredns/coredns/pull/8000)
• plugin/dnssec: Return nil sigs on sign error (https://github.com/coredns/coredns/pull/7999)
• plugin/dnsserver: Allow view server blocks in any declaration order (https://github.com/coredns/coredns/pull/8001)
• plugin/file: Expand SVCB/HTTPS record support (https://github.com/coredns/coredns/pull/7950)
• plugin/file: Fix data race in xfr.go (https://github.com/coredns/coredns/pull/8039)
• plugin/file: Introduce snapshot()/setData() accessors for zone data (https://github.com/coredns/coredns/pull/8040)
• plugin/file: Protect Zone.Expired with mutex (https://github.com/coredns/coredns/pull/7940)
• plugin/forward: Add max_age option to enforce an absolute connection lifetime (https://github.com/coredns/coredns/pull/7903)
• plugin/kubernetes: Record cluster_ip services in dns_programming_duration metric (https://github.com/coredns/coredns/pull/7951)
• plugin/kubernetes: Sanitize non-UTF-8 host in metrics (https://github.com/coredns/coredns/pull/7998)
• plugin/metrics: Add optional TLS support to /metrics endpoint (https://github.com/coredns/coredns/pull/7255)
• plugin/metrics: Allow selectively exporting all Go runtime metrics (https://github.com/coredns/coredns/pull/7990)
• plugin/ready: fix Reset list of readiness plugins (https://github.com/coredns/coredns/pull/8035)
• plugin/secondary: Send NOTIFY messages after zone transfer (https://github.com/coredns/coredns/pull/7901)
• plugin/tls: Add the keylog option to configure TLSConfig.KeyLogWriter (https://github.com/coredns/coredns/pull/7537)
• plugin/tls: Use temp dir for keylog test path (https://github.com/coredns/coredns/pull/8010)
• plugin/transfer: Batch AXFR records by message size instead of count (https://github.com/coredns/coredns/pull/8002)
• plugin/transfer: Fix case-sensitive zone handling for AXFR/IXFR (https://github.com/coredns/coredns/pull/7899)
• plugin/transfter: Fix longestMatch to select the most specific zone correctly (https://github.com/coredns/coredns/pull/7949)
• plugin/tsig: Add require_opcode directive for opcode-based TSIG (https://github.com/coredns/coredns/pull/7828)
• proxyproto: Add UDP session tracking for Cloudflare Spectrum PPv2 (https://github.com/coredns/coredns/pull/7967)

下载链接

• coredns_1.14.3_darwin_amd64.tgz
• coredns_1.14.3_darwin_amd64.tgz.sha256
• coredns_1.14.3_darwin_arm64.tgz
• coredns_1.14.3_darwin_arm64.tgz.sha256
• coredns_1.14.3_linux_amd64.tgz
• coredns_1.14.3_linux_amd64.tgz.sha256
• coredns_1.14.3_linux_arm.tgz
• coredns_1.14.3_linux_arm.tgz.sha256
• coredns_1.14.3_linux_arm64.tgz
• coredns_1.14.3_linux_arm64.tgz.sha256
• coredns_1.14.3_linux_mips.tgz
• coredns_1.14.3_linux_mips.tgz.sha256
• coredns_1.14.3_linux_mips64le.tgz
• coredns_1.14.3_linux_mips64le.tgz.sha256
• coredns_1.14.3_linux_ppc64le.tgz
• coredns_1.14.3_linux_ppc64le.tgz.sha256
• coredns_1.14.3_linux_riscv64.tgz
• coredns_1.14.3_linux_riscv64.tgz.sha256
• coredns_1.14.3_linux_s390x.tgz
• coredns_1.14.3_linux_s390x.tgz.sha256
• coredns_1.14.3_windows_amd64.tgz
• coredns_1.14.3_windows_amd64.tgz.sha256
• coredns_1.14.3_windows_amd64.zip
• coredns_1.14.3_windows_amd64.zip.sha256