The usual suspects.
Most Corefiles out there lean on a handful of plugins. Here’s what they do and how they look.
kubernetes
Your cluster’s Services and Pods, as DNS names.
kubernetes cluster.localforward
Sends anything you don’t own to upstream resolvers, over plain DNS or TLS.
forward . 1.1.1.1 9.9.9.9cache
Remembers answers so the next ask comes back instantly.
cache 30rewrite
Changes names, types or answers on the way through.
rewrite name old.example new.examplefile
Serves a zone straight from a good old zone file.
file db.example.orgprometheus
Metrics your dashboards already know, with
pharos_in place ofcoredns_.prometheus :9153
The whole toolbox.
Grouped by what you’d reach for them to do. Write them in your Corefile in any order you like.
Serve your zones 11
Answer from zone files, hosts files, templates or a signed zone.
- file
- auto
- secondary
- hosts
- template
- transfer
- dynupdate
- sign
- dnssec
- whoami
- chaos
Find your services 7
Turn clusters and cloud registries into DNS names.
- kubernetes
- k8s_external
- etcd
- nomad
- route53
- azure
- clouddns
Forward and cache 4
Send what you don’t own upstream, and remember the answer.
- forward
- grpc
- cache
- loop
Rewrite and shape 14
Bend queries and responses to fit your network.
- rewrite
- header
- minimal
- any
- loadbalance
- autopath
- dns64
- siit
- bufsize
- nsid
- local
- view
- metadata
- geoip
Listen and lock down 8
Encrypted transports and who gets to ask.
- tls
- quic
- https
- https3
- grpc_server
- proxyproto
- acl
- tsig
Keep an eye on it 10
Metrics, logs, traces and probes.
- prometheus
- log
- errors
- dnstap
- trace
- debug
- pprof
- health
- ready
- erratic
Run the server 8
Ports, reloads, timeouts and load shedding.
- root
- bind
- reload
- multisocket
- cancel
- timeouts
- shed
- on
Speak every transport.
Plain DNS for the LAN, encrypted DNS for everywhere else. Pick a scheme in front of your zone and you’re done.
- dns://
- UDP and TCP
- tls://
- DNS over TLS
- quic://
- DNS over QUIC
- https://
- DNS over HTTPS
- https3://
- DoH over HTTP/3
- grpc://
- CoreDNS dns.proto
Try it on your Corefile.
Ask Pharos what it thinks of your config, then let it serve. It reads /etc/pharos/pharos.conf, so one mount is all it takes.
# see what changes for your Corefile, if anything$ docker run --rm \-v "$PWD/Corefile:/etc/pharos/pharos.conf:ro" \ghcr.io/itsmeyaw/pharos:1.0.0 check # serve it on port 53$ docker run --rm -p 53:53/udp -p 53:53/tcp \-v "$PWD/Corefile:/etc/pharos/pharos.conf:ro" \ghcr.io/itsmeyaw/pharos:1.0.0