发布日期: 2026-08-19
版本号: v1.14.7

本次发布增强了DNS缓存、转发和传输可靠性，改进了过期缓存行为、上游处理安全性和连接与过载控制。同时新增了ACME管理TLS、拓扑感知Kubernetes服务、HTTP/2转发、DNS-over-QUIC和辅助区域管理等功能，并在文件服务、重写、ACL、主机、传输及Kubernetes处理等方面提供了多项正确性和性能修复。该版本基于Go 1.26.6构建，包含对CVE-2026-56865、CVE-2026-56864和CVE-2026-33818的修复。

更新内容 （中文）

此版本增强了DNS缓存、转发和传输可靠性，改进了陈旧缓存行为、更安全的上游处理以及更严格的连接与过载控制。同时新增了对ACME管理TLS、拓扑感知Kubernetes服务、HTTP/2转发、DNS-over-QUIC和辅助区管理的支持，并修复了文件服务、重写、ACL、hosts文件、区域传输和Kubernetes处理方面的正确性与性能问题。该版本基于Go 1.26.6构建，包含对CVE-2026-56865、CVE-2026-56864和CVE-2026-33818的修复。

贡献者

Baltasar Blanco
houyuwushang
Karan V
liucongran
llucas
Manuel Rüger
maximilize
Mehrdad Biukian
Michael Wolf
Ncesam
Nikolaus Schuetz
Nitin Nizhawan
Omkhar Arasaratnam
Pujitha Paladugu
rpb-ant
Saleh
Sueun Cho
Ville Vesilehto
Yash Singh
Yong Tang

重要变更

核心：为DNS-over-QUIC添加连接级并发限制（https://github.com/coredns/coredns/pull/8213）
核心：为HTTP/3添加最大连接数限制（https://github.com/coredns/coredns/pull/8187）
核心：文档化进程内嵌入机制（https://github.com/coredns/coredns/pull/8436）
核心：使密钥日志路径测试具备可移植性（https://github.com/coredns/coredns/pull/8311）
核心：规范化服务器区块区域（https://github.com/coredns/coredns/pull/8320）
核心：为非root用户固定数字uid/gid（https://github.com/coredns/coredns/pull/8316）
插件/acl：修复autopath绕过acl检查的问题（https://github.com/coredns/coredns/pull/8290）
插件/acl：修复被阻止的客户端接收缓存DNS应答的问题（https://github.com/coredns/coredns/pull/8289）
插件/auto：修复重复源警告中颠倒的参数（https://github.com/coredns/coredns/pull/8317）
插件/cache：添加prefer_positive陈旧策略（https://github.com/coredns/coredns/pull/8378）
插件/cache：将响应和条目绑定到QCLASS（https://github.com/coredns/coredns/pull/8272）
插件/cache：配置陈旧TTL和失败重新检查（https://github.com/coredns/coredns/pull/8411）
插件/cache：不再缓存无SOA的NODATA响应（https://github.com/coredns/coredns/pull/8232）
插件/cache：修复缓存陈旧验证元数据竞争条件（https://github.com/coredns/coredns/pull/8366）
插件/cache：存储缓存条目时保留AD标志（https://github.com/coredns/coredns/pull/8438）
插件/cache：TTL到期时保留单调时间（https://github.com/coredns/coredns/pull/8346）
插件/file：不跨越更近的空非终端展开通配符（https://github.com/coredns/coredns/pull/8223）
插件/file：修复多主AXFR区域污染问题（https://github.com/coredns/coredns/pull/8367）
插件/file：修复零值SOA刷新时的panic（https://github.com/coredns/coredns/pull/8276）
插件/file：处理空非终端通配符源（https://github.com/coredns/coredns/pull/8386）
插件/file：仅解析每个附加段目标一次（https://github.com/coredns/coredns/pull/8286）
插件/file：别名解析后返回委派（https://github.com/coredns/coredns/pull/8341）
插件/file：为CNAME/DNAME应答运行附加处理（https://github.com/coredns/coredns/pull/8337）
插件/file：阻止自引用DNAME循环（https://github.com/coredns/coredns/pull/8418）
插件/forward：添加http(2)主机/授权头和TO服务器解析（https://github.com/coredns/coredns/pull/8233）
插件/forward：限制默认连接尝试次数（https://github.com/coredns/coredns/pull/8365）
插件/forward：isAllowedDomain中的快速路径字符串比较（https://github.com/coredns/coredns/pull/8385）
插件/forward：修复错误的故障转移计数器重置（https://github.com/coredns/coredns/pull/8277）
插件/forward：修复本地DNS消息序列化失败的错误重试（https://github.com/coredns/coredns/pull/8313）
插件/forward：修复DoH健康检查使用默认TLS而非配置CA的问题（https://github.com/coredns/coredns/pull/8279）
插件/forward：修复UDP转发，使格式错误的上游数据报不会阻塞后续有效数据报（https://github.com/coredns/coredns/pull/8287）
插件/hosts：使不支持类型的直通转为可选（https://github.com/coredns/coredns/pull/8282）
插件/hosts：在设置时将Origins预转换为plugin.Zones（https://github.com/coredns/coredns/pull/8383）
插件/kubernetes：通过"az-pinned"子域添加对拓扑感知无头服务的支持（https://github.com/coredns/coredns/pull/8388）
插件/kubernetes：添加端点/服务导入等效性检查测试（https://github.com/coredns/coredns/pull/8368）
插件/kubernetes：在Pod.DeepCopyObject中复制标签（https://github.com/coredns/coredns/pull/8415）
插件/kubernetes：在AutoPath中预分配搜索路径切片容量（https://github.com/coredns/coredns/pull/8381）
插件/kubernetes：在控制器查询查找中预分配切片容量（https://github.com/coredns/coredns/pull/8343）
插件/kubernetes：短路匹配portAndProtocol并进行快速路径字符串匹配（https://github.com/coredns/coredns/pull/8344）
插件/kubernetes：在DNS中立pod更新时跳过区域序列号递增（https://github.com/coredns/coredns/pull/8338）
插件/proxyproto：即使在没有允许列表的情况下也应用显式配置的默认策略（https://github.com/coredns/coredns/pull/8278）
插件/rewrite：规范化精确的cname重写目标并保留所有记录（https://github.com/coredns/coredns/pull/8285）
插件/rewrite：重写期间保留原始请求（https://github.com/coredns/coredns/pull/8235）
插件/rewrite：测试记录存在和替换路径时的EDNS0回退（https://github.com/coredns/coredns/pull/8315）
插件/secondary：在ID变更时重置目录成员（https://github.com/coredns/coredns/pull/8281）
插件/secondary：支持目录迁移和成员范围界定（https://github.com/coredns/coredns/pull/8288）
插件/shed：添加UDP过载保护插件（https://github.com/coredns/coredns/pull/8312）
插件/timeouts：添加maxtcpqueries选项限制每个TCP/TLS连接的查询数（https://github.com/coredns/coredns/pull/8376）
插件/tls：通过ACME DNS-01管理证书（https://github.com/coredns/coredns/pull/8310）
插件/trace：支持trace插件中的IPv6服务端点（https://github.com/coredns/coredns/pull/8410）
插件/transfer：收集所有通知错误而非掩盖（https://github.com/coredns/coredns/pull/8283）

更新内容 （原始）

This release strengthens DNS caching, forwarding, and transport reliability, with improved stale-cache behavior, safer upstream handling, and tighter connection and overload controls. It also adds new capabilities for ACME-managed TLS, topology-aware Kubernetes services, HTTP/2 forwarding, DNS-over-QUIC, and secondary zone management, while delivering correctness and performance fixes across file serving, rewrites, ACLs, hosts, transfers, and Kubernetes handling. The release is built with Go 1.26.6 to include fixes for CVE-2026-56865, CVE-2026-56864, and CVE-2026-33818.

Brought to You By

Baltasar Blanco houyuwushang Karan V liucongran llucas Manuel Rüger maximilize Mehrdad Biukian Michael Wolf Ncesam Nikolaus Schuetz Nitin Nizhawan Omkhar Arasaratnam Pujitha Paladugu rpb-ant Saleh Sueun Cho Ville Vesilehto Yash Singh Yong Tang

Noteworthy Changes

core: Add connection-level concurrency limiting to DNS-over-QUIC (https://github.com/coredns/coredns/pull/8213) core: Add max conn limit to https3 (https://github.com/coredns/coredns/pull/8187) core: Document in-process embedding (https://github.com/coredns/coredns/pull/8436) core: Make keylog path test portable (https://github.com/coredns/coredns/pull/8311) core: Normalize server block zones (https://github.com/coredns/coredns/pull/8320) core: Pin numeric uid/gid for the nonroot user (https://github.com/coredns/coredns/pull/8316) plugin/acl: Fix autopath from bypassing acl checks (https://github.com/coredns/coredns/pull/8290) plugin/acl: Fix blocked clients from receiving cached DNS answers (https://github.com/coredns/coredns/pull/8289) plugin/auto: Fix inverted arguments in duplicate-origin warning (https://github.com/coredns/coredns/pull/8317) plugin/cache: Add prefer_positive stale policy (https://github.com/coredns/coredns/pull/8378) plugin/cache: Bind responses and entries to QCLASS (https://github.com/coredns/coredns/pull/8272) plugin/cache: Configure stale TTL and failure recheck (https://github.com/coredns/coredns/pull/8411) plugin/cache: Do not cache SOA-less NODATA responses (https://github.com/coredns/coredns/pull/8232) plugin/cache: Fix cache stale verification metadata race (https://github.com/coredns/coredns/pull/8366) plugin/cache: Preserve AD when storing cache entries (https://github.com/coredns/coredns/pull/8438) plugin/cache: Preserve monotonic time for TTL expiry (https://github.com/coredns/coredns/pull/8346) plugin/file: Do not expand wildcard across a closer empty non-terminal (https://github.com/coredns/coredns/pull/8223) plugin/file: Fixes multi-primary AXFR zone contamination (https://github.com/coredns/coredns/pull/8367) plugin/file: Fix panic on zero-valued SOA refresh (https://github.com/coredns/coredns/pull/8276) plugin/file: Handle empty non-terminal wildcard sources (https://github.com/coredns/coredns/pull/8386) plugin/file: Resolve each additional section target only once (https://github.com/coredns/coredns/pull/8286) plugin/file: Return referrals after alias resolution (https://github.com/coredns/coredns/pull/8341) plugin/file: Run additional processing for CNAME/DNAME answers (https://github.com/coredns/coredns/pull/8337) plugin/file: Stop self-referential DNAME loops (https://github.com/coredns/coredns/pull/8418) plugin/forward: Add http(2) host/authority header and TO server resolution (https://github.com/coredns/coredns/pull/8233) plugin/forward: Cap default connect attempts (https://github.com/coredns/coredns/pull/8365) plugin/forward: Fast-path string comparison in isAllowedDomain (https://github.com/coredns/coredns/pull/8385) plugin/forward: Fix incorrect failover counter reset (https://github.com/coredns/coredns/pull/8277) plugin/forward: Fix incorrect retry of local DNS message serialization failures (https://github.com/coredns/coredns/pull/8313) plugin/forward: Fix issue in DoH health checks used a default TLS instead of the configured CA (https://github.com/coredns/coredns/pull/8279) plugin/forward: Fix UDP forwarding so a malformed upstream datagram wont block valid ones later (https://github.com/coredns/coredns/pull/8287) plugin/hosts: Make unsupported type fallthrough opt-in (https://github.com/coredns/coredns/pull/8282) plugin/hosts: Pre-convert Origins to plugin.Zones in setup (https://github.com/coredns/coredns/pull/8383) plugin/kubernetes: Add support for topology-aware headless services via “az-pinned” subdomains (https://github.com/coredns/coredns/pull/8388) plugin/kubernetes: Add tests for endpoint/service-import equivalence checks (https://github.com/coredns/coredns/pull/8368) plugin/kubernetes: Copy Labels in Pod.DeepCopyObject (https://github.com/coredns/coredns/pull/8415) plugin/kubernetes: Pre-allocate search path slice capacity in AutoPath (https://github.com/coredns/coredns/pull/8381) plugin/kubernetes: Preallocate slice capacities in controller query lookups (https://github.com/coredns/coredns/pull/8343) plugin/kubernetes: Short-circuit matchPortAndProtocol and fast-path string match (https://github.com/coredns/coredns/pull/8344) plugin/kubernetes: Skip zone serial bump on DNS neutral pod updates (https://github.com/coredns/coredns/pull/8338) plugin/proxyproto: Apply an explicitly configured default policy evenwhen no allow list is present. (https://github.com/coredns/coredns/pull/8278) plugin/rewrite: Normalize exact cname rewrite targets and preserve all records (https://github.com/coredns/coredns/pull/8285) plugin/rewrite: Preserve original request during rewrites (https://github.com/coredns/coredns/pull/8235) plugin/rewrite: Test EDNS0 revert with a record present and on the replace path (https://github.com/coredns/coredns/pull/8315) plugin/secondary: Reset catalog members on ID change (https://github.com/coredns/coredns/pull/8281) plugin/secondary: Support catalog migration and member scoping (https://github.com/coredns/coredns/pull/8288) plugin/shed: Add UDP overload protection plugin (https://github.com/coredns/coredns/pull/8312) plugin/timeouts: Add maxtcpqueries option to bound queries per TCP/TLS connection (https://github.com/coredns/coredns/pull/8376) plugin/tls: Manage certificates with ACME DNS-01 (https://github.com/coredns/coredns/pull/8310) plugin/trace: Support IPv6 service endpoints in trace plugin (https://github.com/coredns/coredns/pull/8410) plugin/transfer: Collect all notify errors instead of shadowing (https://github.com/coredns/coredns/pull/8283)

下载链接