<< Back to article

DNS with CoreDNS

CoreDNS is a flexible, CNCF-certified DNS server written in Go. It is the default DNS service in Kubernetes but works equally well as a standalone resolver or authoritative server.

Key Features

  • Plugin architecture: Extensible via Go plugins.
  • Kubernetes integration: Native support for cluster DNS, headless services, and external services.
  • Performance: Single binary, low memory footprint.
  • Flexibility: Can act as a forwarder, authoritative server, or both simultaneously.

Installation

Download the latest single binary from GitHub releases.

Create directories and a service user:

mkdir -p /opt/coredns/zones
useradd --system --shell /usr/sbin/nologin --no-create-home coredns

systemd Service

Define a systemd unit at /etc/systemd/system/coredns.service:

[Unit]
Description=CoreDNS
After=network.target

[Service]
ExecStart=/opt/coredns/coredns -conf /opt/coredns/Corefile
Restart=on-failure
RestartSec=5s
WorkingDirectory=/opt/coredns
User=coredns

[Install]
WantedBy=multi-user.target

Enable and start:

systemctl daemon-reload
systemctl enable --now coredns
journalctl -f -u coredns

Corefile Configuration

The Corefile is CoreDNS's configuration. Each block defines how to handle queries for specific domains.

DNS Forwarder

Forward all queries to upstream resolvers:

. {
    forward . /etc/resolv.conf 1.1.1.1 8.8.8.8
    errors
    cache 30
    ready
    reload 5s
}

Authoritative Zone with Forwarding

Serve a local zone and forward everything else:

intra.net {
    file /opt/coredns/zones/intra.net.db
    forward lxe.intra.net 192.168.20.10
    forward dev.intra.net 10.70.0.10:54
}

. {
    forward . /etc/resolv.conf 1.1.1.1
    errors
    cache 30
}

Zone File Example

A BIND-style zone file at /opt/coredns/zones/intra.net.db:

$ORIGIN intra.net.
$TTL 3600
@   IN  SOA ns1.lxe.intra.net. admin.lxe.intra.net. (
        16578 ; serial
        3600       ; refresh
        1800       ; retry
        1209600    ; expire
        3600 )     ; minimum

prod.vpn.dmz IN A 10.255.0.1
k8s.dmz      IN A 192.168.255.2
home         IN A 192.168.10.2
guest        IN A 192.168.0.2

Note: reload in the Corefile enables automatic zone reloading when files change. If you modify a zone file, increment the serial number for the change to take effect.

Docker Deployment

CoreDNS runs well in Docker for dynamic service discovery:

TODO: Add Dockerfile and entrypoint script showing how to deploy CoreDNS in Docker with dynamic resolution.

Verification

Test DNS resolution:

dig @127.0.0.1 example.com
dig @127.0.0.1 intra.net