This release strengthens DNS caching, forwarding, and transport reliability, with
improved stale-cache behavior, safer upstream handling, and tighter connection
and overload controls. It also adds new capabilities for ACME-managed TLS,
topology-aware Kubernetes services, HTTP/2 forwarding, DNS-over-QUIC, and
secondary zone management, while delivering correctness and performance fixes
across file serving, rewrites, ACLs, hosts, transfers, and Kubernetes handling.
The release is built with Go 1.26.6 to include fixes for CVE-2026-56865,
CVE-2026-56864, and CVE-2026-33818.
Brought to You By
Baltasar Blanco
houyuwushang
Karan V
liucongran
llucas
Manuel Rüger
maximilize
Mehrdad Biukian
Michael Wolf
Ncesam
Nikolaus Schuetz
Nitin Nizhawan
Omkhar Arasaratnam
Pujitha Paladugu
rpb-ant
Saleh
Sueun Cho
Ville Vesilehto
Yash Singh
Yong Tang
Noteworthy Changes
core: Add connection-level concurrency limiting to DNS-over-QUIC (#8213)
core: Add max conn limit to https3 (#8187)
core: Document in-process embedding (#8436)
core: Make keylog path test portable (#8311)
core: Normalize server block zones (#8320)
core: Pin numeric uid/gid for the nonroot user (#8316)
plugin/acl: Fix autopath from bypassing acl checks (#8290)
plugin/acl: Fix blocked clients from receiving cached DNS answers (#8289)
plugin/auto: Fix inverted arguments in duplicate-origin warning (#8317)
plugin/cache: Add prefer_positive stale policy (#8378)
plugin/cache: Bind responses and entries to QCLASS (#8272)
plugin/cache: Configure stale TTL and failure recheck (#8411)
plugin/cache: Do not cache SOA-less NODATA responses (#8232)
plugin/cache: Fix cache stale verification metadata race (#8366)
plugin/cache: Preserve AD when storing cache entries (#8438)
plugin/cache: Preserve monotonic time for TTL expiry (#8346)
plugin/file: Do not expand wildcard across a closer empty non-terminal (#8223)
plugin/file: Fixes multi-primary AXFR zone contamination (#8367)
plugin/file: Fix panic on zero-valued SOA refresh (#8276)
plugin/file: Handle empty non-terminal wildcard sources (#8386)
plugin/file: Resolve each additional section target only once (#8286)
plugin/file: Return referrals after alias resolution (#8341)
plugin/file: Run additional processing for CNAME/DNAME answers (#8337)
plugin/file: Stop self-referential DNAME loops (#8418)
plugin/forward: Add http(2) host/authority header and TO server resolution (#8233)
plugin/forward: Cap default connect attempts (#8365)
plugin/forward: Fast-path string comparison in isAllowedDomain (#8385)
plugin/forward: Fix incorrect failover counter reset (#8277)
plugin/forward: Fix incorrect retry of local DNS message serialization failures (#8313)
plugin/forward: Fix issue in DoH health checks used a default TLS instead of the configured CA (#8279)
plugin/forward: Fix UDP forwarding so a malformed upstream datagram wont block valid ones later (#8287)
plugin/hosts: Make unsupported type fallthrough opt-in (#8282)
plugin/hosts: Pre-convert Origins to plugin.Zones in setup (#8383)
plugin/kubernetes: Add support for topology-aware headless services via "az-pinned" subdomains (#8388)
plugin/kubernetes: Add tests for endpoint/service-import equivalence checks (#8368)
plugin/kubernetes: Copy Labels in Pod.DeepCopyObject (#8415)
plugin/kubernetes: Pre-allocate search path slice capacity in AutoPath (#8381)
plugin/kubernetes: Preallocate slice capacities in controller query lookups (#8343)
plugin/kubernetes: Short-circuit matchPortAndProtocol and fast-path string match (#8344)
plugin/kubernetes: Skip zone serial bump on DNS neutral pod updates (#8338)
plugin/proxyproto: Apply an explicitly configured default policy evenwhen no allow list is present. (#8278)
plugin/rewrite: Normalize exact cname rewrite targets and preserve all records (#8285)
plugin/rewrite: Preserve original request during rewrites (#8235)
plugin/rewrite: Test EDNS0 revert with a record present and on the replace path (#8315)
plugin/secondary: Reset catalog members on ID change (#8281)
plugin/secondary: Support catalog migration and member scoping (#8288)
plugin/shed: Add UDP overload protection plugin (#8312)
plugin/timeouts: Add maxtcpqueries option to bound queries per TCP/TLS connection (#8376)
plugin/tls: Manage certificates with ACME DNS-01 (#8310)
plugin/trace: Support IPv6 service endpoints in trace plugin (#8410)
plugin/transfer: Collect all notify errors instead of shadowing (#8283)