CoreDNS-Container Service for Kubernetes(ACK)-阿里云帮助中心

Default DNS service discovery add-on for ACK clusters and ACK Edge clusters, also available for ACK Serverless clusters.

Overview

CoreDNS resolves both in-cluster service domains and external domains. It is hosted by the CNCF. See CoreDNS: DNS and Service Discovery.

CoreDNS has two editions: unmanaged and managed. See DNS-based service discovery.

For CoreDNS and Kubernetes version compatibility, see CoreDNS version in Kubernetes.

Usage notes

Application pod DNS settings also affect resolution. See Configure DNS policies and domain name resolution.
Before upgrading an unmanaged CoreDNS add-on:
- Read the CoreDNS upgrade instructions before upgrading.
- Back up the coredns ConfigMap in the kube-system namespace.
CoreDNS unavailability can severely affect other cluster services.
- Unmanaged CoreDNS: You manage availability. See Stability and high-performance deployment recommendations for unmanaged CoreDNS.
- Managed CoreDNS: Alibaba Cloud ensures its availability. See Performance of managed CoreDNS.

Release notes

Unmanaged

Version	Applicable cluster	Image address	Release date	Changes	Impact
v1.13.2.2	Kubernetes 1.27 or later	registry.{{.Region}}.aliyuncs.com/acs/coredns:v1.13.2.2	May 25, 2026	Updated to the community version v1.13.2. CVE fixes: plugin/quic: Limited the number of concurrent DoQ streams and goroutines (#7296) to fix the DoQ Memory Exhaustion via Stream Amplification vulnerability (CVE-2025-47950 / GHSA-cvx7-x8pj-x2gw). core: Upgraded Go to 1.25.9 and golang.org/x/net to v0.45.0 to fix multiple critical CVEs. plugin/etcd: Fixed a DNS cache pinning vulnerability where a lease ID was incorrectly used as a TTL (CVE-2025-58063 / GHSA-93mf-426m-g6x9). Improvements: Added support for custom scheduling configurations for the add-on. plugin/header: Removed deprecated syntax (#7436). As of v1.9.4, the implicit selector syntax (where `query` or `response` is not specified) is removed. Configurations that generated a `[WARNING]` now cause a `plugin/header: setting up rule: invalid selector=... should be query or response` error and fail to start. plugin/secondary: The transfer property is now required (#7249). A `secondary` block without `transfer from`, previously parsed but ignored, now causes an `unknown property '...'` error and fails to start. plugin/forward: No longer accepts `NOERROR` responses during failover (#7622). plugin/forward: Added a failover option to fail over to the next upstream server when a SERVFAIL or REFUSED response is received (#7458). plugin/grpc: Enforced DNS message size limits (#7490). plugin/kubernetes: Added the `startup_timeout` configuration to the `kubernetes` plugin (#7068). plugin/file: Added `fallthrough` support (#7327).	This upgrade does not affect your workloads.
v1.12.1.3	Kubernetes 1.27 or later	registry.{{.Region}}.aliyuncs.com/acs/coredns:v1.12.1.3	November 5, 2025	Improvements: Added matchLabelKeys to `topologySpreadConstraints` to prevent CoreDNS pods from concentrating in a single zone after rolling updates. See Use scheduling policies to achieve high availability for CoreDNS.	This upgrade does not affect your workloads.
v1.12.1.2	Kubernetes 1.21 or later	registry.{{.Region}}.aliyuncs.com/acs/coredns:v1.12.1.2	October 10, 2025	Improvements: Removed the `aliyun` suffix from the add-on version number. Default `cache` plugin `serve_stale` configuration changed to `serve_stale 30s verify`.	This upgrade does not affect your workloads.
v1.12.1.1-4035d7a99-aliyun	Kubernetes 1.21 or later	registry.{{.Region}}.aliyuncs.com/acs/coredns:v1.12.1.1-4035d7a99-aliyun	July 22, 2025	Updated to the community version v1.12.1. Added the multisocket plugin. Increased the CNAME lookup limit from 7 to 10. plugin/kubernetes: Fixed an issue where queries could be resolved to a deleted pod due to `DeletionTimestamp` (#7119) (#7131). plugin/kubernetes: Reverted the change "Create PTR records only for endpoints that have a hostname defined" (#6898). plugin/forward: Added the option `failfast_all_unhealthy_upstreams` to return `servfail` when all upstream servers are down. The `cache` plugin enables `serve_stale` by default. When an upstream DNS server is unavailable, it serves a stale-cache response (TTL 0) and asynchronously retrieves the latest address.	This upgrade does not affect your workloads.
v1.11.3.5-5321daf49-aliyun	Kubernetes 1.21 or later	registry.{{.Region}}.aliyuncs.com/acs/coredns:v1.11.3.5-5321daf49-aliyun	March 19, 2025	Updated the base image to patch identified security vulnerabilities. Added Lingjun node pool support. CoreDNS pods skip Lingjun nodes.	This upgrade does not affect your workloads.
v1.11.3.2-f57ea7ed6-aliyun	Kubernetes 1.21 or later	registry.{{.Region}}.aliyuncs.com/acs/coredns:v1.11.3.2-f57ea7ed6-aliyun	October 21, 2024	Added support for the firewall plugin. The forward plugin now supports proceeding to the next plugin based on the response code. CoreDNS add-on topology constraints are now customizable on the Operations > Add-ons page.	This upgrade does not affect your workloads.
v1.9.3.16-4341f22f-aliyun	ACK Serverless clusters running Kubernetes 1.20.4 or later only	registry.{{.Region}}.aliyuncs.com/acs/coredns:v1.9.3.16-4341f22f-aliyun	May 9, 2023	Default memory request for CoreDNS containers increased to 4 GiB to avoid scheduling to shared instances. Customize via add-on configuration.	CoreDNS may use a higher-specification Elastic Container Instance (ECI) after this upgrade.
v1.9.3.10-7dfca203-aliyun	Kubernetes 1.20.4 or later	registry.{{.Region}}.aliyuncs.com/acs/coredns:v1.9.3.10-7dfca203-aliyun	April 3, 2023	Optimized zone-level anti-affinity scheduling. Reduced the likelihood of pod eviction on elastic nodes.	If all schedulable nodes are in a single zone, CoreDNS replicas may fail to schedule, causing the upgrade to fail. To ensure DNS availability, add nodes in multiple zones.
v1.9.3.6-32932850-aliyun	Kubernetes 1.20.4 or later	registry.{{.Region}}.aliyuncs.com/acs/coredns:v1.9.3.6-32932850-aliyun	August 25, 2022	Added support for delivering Kubernetes events. For ACK Serverless clusters, the default CPU request is changed to 2 vCores.	This upgrade does not affect your workloads.
v1.9.3.2-8850b5e7-aliyun	Kubernetes 1.20.4 or later	registry.{{.Region}}.aliyuncs.com/acs/coredns:v1.9.3.2-8850b5e7-aliyun	August 3, 2022	You can enable the CoreDNS log collection feature in Log Center with a single click.	This upgrade does not affect your workloads.
v1.9.3.1-5e7ba42d-aliyun	Kubernetes 1.20.4 or later	registry.{{.Region}}.aliyuncs.com/acs/coredns:v1.9.3.1-5e7ba42d-aliyun	July 11, 2022	Fixed several issues and improved some features. See CoreDNS-1.9.3 Release. Added support for multi-cluster services in ACK One.	This upgrade does not affect your workloads.
v1.8.4.5-2ce07fd2-aliyun	Kubernetes 1.20.4 or later	registry.{{.Region}}.aliyuncs.com/acs/coredns:v1.8.4.5-2ce07fd2-aliyun	April 8, 2022	Optimized CoreDNS scheduling affinity to support clusters with all elastic nodes.	This upgrade does not affect your workloads.
v1.8.4.3-644f4735-aliyun	Kubernetes 1.20.4 or later	registry.{{.Region}}.aliyuncs.com/acs/coredns:v1.8.4.3-644f4735-aliyun	February 22, 2022	Disabled caching for ServError DNS responses. Changed hostname-based anti-affinity from `preferred` to `required`, enforcing node-level anti-affinity.	Enforces node-level anti-affinity. If CoreDNS replicas exceed the node count, excess replicas enter `Pending` state. Before upgrading, scale out nodes or scale in replicas.
v1.8.4.2-7d597cff-aliyun	Kubernetes 1.20.4 or later	registry.{{.Region}}.aliyuncs.com/acs/coredns:v1.8.4.2-7d597cff-aliyun	January 10, 2022	Added support for custom parameters. Enabled resolution logging by default.	This upgrade does not affect your workloads.
v1.8.4.1-3a376cc-aliyun	Kubernetes 1.20.4 or later	registry.{{.Region}}.aliyuncs.com/acs/coredns:v1.8.4.1-3a376cc-aliyun	October 26, 2021	Added support for watching EndpointSlices resources. Added support for DNS queries over IPv6 addresses.	This upgrade does not affect your workloads.
v1.7.0.0-f59c03d-aliyun	Kubernetes 1.14.8 or later	registry.{{.Region}}.aliyuncs.com/acs/coredns:v1.7.0.0-f59c03d-aliyun	July 8, 2021	Modified the default graceful shutdown period and the container memory limit in the CoreDNS Deployment. Updated metric names. If your monitoring relies on CoreDNS metrics, update accordingly. See Metric Changes. Fixed an issue where the forward plugin used only the first upstream DNS server. Removed the deprecated upstream plugin. If your Corefile contains it, the plugin is automatically removed during upgrade.	If you modified /etc/resolv.conf on an ECS instance, upgrading or recreating a CoreDNS pod adopts the modified /etc/resolv.conf. Verify that all DNS servers in the configuration work before upgrading.
1.6.7.edge (Discontinued)	-	registry.{{.Region}}.aliyuncs.com/acs/coredns:1.6.7.edge	April 23, 2021	Based on the community version 1.6.7. See CoreDNS-1.6.7 Release.	This upgrade does not affect your workloads.
v1.7.0	-	registry.{{.Region}}.aliyuncs.com/acs/coredns:1.7.0	March 18, 2021	Removed the deprecated upstream plugin. If your Corefile contains it, the plugin is automatically removed during upgrade. Updated metric names. If your monitoring relies on CoreDNS metrics, update accordingly. See Metric Changes. Fixed an issue where the forward plugin used only the first upstream DNS server.	If you modified /etc/resolv.conf on an ECS instance, upgrading or recreating a CoreDNS pod adopts the modified /etc/resolv.conf. Verify that all DNS servers in the configuration work before upgrading.
v1.6.7 (Discontinued)	-	registry.{{.Region}}.aliyuncs.com/acs/coredns:1.6.7	November 28, 2018	Based on the community version 1.6.7. See CoreDNS-1.6.7 Release.	This upgrade does not affect your workloads.

Managed

Version	Applicable cluster	Image address	Release date	Changes	Impact
v1.12.1.2	Kubernetes 1.21 or later	registry.{{.Region}}.aliyuncs.com/acs/coredns:v1.12.1.2	October 10, 2025	Improvements: Updated to the community version v1.12.1. In a cluster that does not have the IPv6 dual-stack feature enabled, a query for an AAAA record will directly return `nodata`. The multisocket plugin is enabled by default to enhance performance.	This upgrade does not affect your workloads.
v1.11.3.2-f57ea7ed6-aliyun	Kubernetes 1.21 or later	registry.{{.Region}}.aliyuncs.com/acs/coredns:v1.11.3.2-f57ea7ed6-aliyun	October 21, 2024	Added support for the firewall plugin. The forward plugin now supports proceeding to the next plugin based on the response code. CoreDNS add-on topology constraints are now customizable on the Operations > Add-ons page.	This upgrade does not affect your workloads.
v1.9.3.10-7dfca203-aliyun	Kubernetes 1.20.4 or later	registry.{{.Region}}.aliyuncs.com/acs/coredns:v1.9.3.10-7dfca203-aliyun	April 3, 2023	Optimized zone-level anti-affinity scheduling. Reduced the likelihood of pod eviction on elastic nodes.	If all schedulable nodes are in a single zone, CoreDNS replicas may fail to schedule, causing the upgrade to fail. To ensure DNS availability, add nodes in multiple zones.