CoreDNS Groups

CoreDNS groups are collections of settings that govern how CoreDNS responds to queries from clients within specific networks. Use groups to match pattern expressions in queries and block, redirect, or redefine responses.

Managing Groups

By default, there is one group, the Default Group. This group is special in that it defines the default behavior of CoreDNS for clients not matched by other groups. Additional groups define different behavior for different prefixes, and can choose to fall back to the Default Group to avoid duplicating settings across multiple groups.

Creating Groups

To add a new group:

• Navigate to Services > CoreDNS

• Click the button to the right of the group list:

  

  Add a CoreDNS Group

• Fill in the Group Name and Group Prefix as described in Group Settings

• Click OK

Group Settings

A group is defined by two components:

Group Name

The name of the group, which will appear as a tab at the top of this section.

Note

This name cannot be changed.

Group Prefix

A network prefix for which this group of settings applies. For example, each interface subnet could have a separate group. This is somewhat analogous to the concept commonly called a “DNS View”.

Once created, groups have one additional option toggle:

Allow Fallback

When enabled, if a query is not matched by any expressions on this group, CoreDNS will consult the settings on the Default Group. This can avoid duplicating common settings between multiple tabs, but some use cases call for additional client setting isolation.

Warning

CoreDNS checks the entire group before fallback. It does not fall back for each section individually.

Group Contents

Each group contains items which alter how CoreDNS responds to queries.

DNS Servers

The entries in the DNS Servers list are the upstream DNS Servers to which CoreDNS will send its own DNS queries for this group by default. This can be overridden on a case-by-case basis as needed by entries in the Forwards settings.

Tip

A common value for this setting is 127.0.0.1:5353 to forward queries to a local instance of the DNS Resolver running on port 5353.

CoreDNS sends queries to the defined servers in parallel and returns the first available response to clients, which improves speed and reliability. As long as one DNS server responds, clients will receive a timely response without waiting for other servers to timeout first.

Blocks

The entries in the Block list will deny queries from clients if they match any of the defined Expressions. CoreDNS will check each pattern in this list for matches, and if it encounters a match, the client will receive an NXDOMAIN response.

Expression

An Expression to match and block queries.

Blocklists

This section controls which Blocklists, if any, apply to this group. Click the drop-down control and select Blocklists as needed, or click Select All.

To remove a Blocklist from this group, click the icon next to its name.

Note

Blocklists managed by ThreatGate and which are configured for Always Block behavior will appear in this list and cannot be removed.

Forwards

The entries in the Forwards list redirect queries to alternate upstream DNS servers. This can be useful to forward queries for an internal domain to a DNS server across a VPN, for example.

Expression

An Expression to match and trigger forwarding behavior for queries.

DNS Servers

A list of one or more DNS servers to which CoreDNS will forward the query. CoreDNS queries these servers in parallel and returns the fastest response.

Resolver

The entries in the Resolver list define local responses for queries that prevent the queries from being passed on to other servers. This can be used to define records internal or local hosts, or even to deliver responses to clients which direct them to different servers entirely for matched expressions.

Expression

An Expression to match and resolve locally.

Addresses

One or more IP address responses. CoreDNS will respond using these entries in round-robin fashion.

Domains

One or more hostnames to deliver as CNAME responses. CoreDNS will respond using these entries in round-robin fashion.

Note

An entry should only contain Addresses or Domains, not both.

Group Processing Order

The rexdns plugin processes the components of a group in the following order:

1. Blocking rules

   Expressions which disallow resolving take precedence and prevent further processing.

2. Resolve rules

   Local resolution expressions which return static answers for allowed queries and prevent those queries from being forwarded to other DNS servers.

3. Forward rules

   Expressions which redirect matching allowed queries to other servers.

4. Fallback rules

   If CoreDNS is processing a non-default group which has Allow Fallback enabled and no expressions matched to this point, CoreDNS will start at the top again but checking the Default Group instead.

5. DNS Server

   Any query not matched by other group components is forwarded to the upstream DNS servers.