CoreDNS v1.14.4

This release focuses on hardening transport security for modern protocols like DoH3 and DoQ, while introducing highly requested operational flexibility like hostname-based forwarding and automatic zone file reloads. Significant improvements were also made to DNSSEC signing logic and cache management.

Hostname resolution for forward upstream targets — Administrators can now use hostnames instead of static IP addresses for upstream DNS servers. This is critical for environments where upstream DNS IP addresses are dynamic or managed by cloud-native services.

Enhanced transport security for DoH3 and TLS — Strengthens protection against potential resource exhaustion attacks in DNS-over-HTTP/3 and cleans up redundant TLS configurations, ensuring better alignment with modern security standards.

Improved DNSSEC signing logic accuracy — Corrects a DNSSEC signing edge case where RRsets were signed using the query zone rather than the owning zone, ensuring stricter compliance with DNS specifications and better validation reliability.

Automatic zone reloading based on file modification time — Allows CoreDNS to automatically detect zone file changes on disk via filesystem timestamps and reload them, reducing the need for manual process signals or restarts when updating local zones.

Extended cache TTLs and stale data verification timeouts — Provides more control over cache behavior, specifically allowing longer TTLs and introducing a verify timeout for stale data to prevent blocking lookups on slow upstream verifications.