CoreDNS v1.14.5

v1.14.5 focuses on core security hardening and operational stability. Key additions include DNS-over-HTTPS support for upstream forwarding, wildcard support in the hosts plugin, and significant panic fixes across the Kubernetes and Rewriting subsystems. The release also improves transport security by adopting standard Go TLS defaults and refining timeout handling for encrypted protocols.

Hardened TLS Defaults and DoH Security — Adopting Go's standard TLS defaults and sanitizing DNS-over-HTTPS error messages reduces the attack surface and ensures CoreDNS follows modern security best practices for encrypted DNS traffic.

Enhanced Forwarding with DoH Support — Administrators can now use DNS-over-HTTPS (DoH) for upstream forwarding and have more granular control over read timeouts, allowing for more resilient and secure DNS resolution in high-latency or untrusted networks.

Critical Stability and Panic Fixes — Resolves several potential crashes in the Kubernetes, Transfer, and Rewrite plugins, ensuring that the DNS server remains stable even when encountering malformed records or specific EDNS0 response scenarios.

Wildcard Support in Hosts Plugin — Users with simple static mapping needs can now use wildcards in their hosts file, providing a more flexible way to manage local name resolution without complex zone files.

Improved DNSTAP Reliability and Connection Handling — Fixes a self-deadlock and connection management issues in the dnstap plugin, ensuring that DNS query logging remains reliable and does not interfere with the primary DNS service.