Mirrors/coredns
1
0
Fork 0
mirror of https://github.com/coredns/coredns.git synced 2026-10-16 23:35:43 -04:00
Code Issues Packages Projects Releases Wiki Activity

Improve RFC links (#8612)

Browse Source 
The `tools.ietf.org` site now redirects to `www.rfc-editor.org`.
* Update various URLs to the new site.
* Make links to `www.rfc-editor.org` consistent.

Signed-off-by: SuperQ <superq@gmail.com>
This commit is contained in:
Ben Kochie
2026-10-08 10:21:06 +02:00
committed by GitHub
parent 763bdb9b76
commit 311a9915da
60 changed files with 1006 additions and 215 deletions
Download Patch File Download Diff File Expand all files Collapse all files

54
man/coredns-dynupdate.7
View File

@@ -1,17 +1,17 @@
.\" Generated by Mmark Markdown Processor - mmark.miek.nl
.TH "COREDNS-DYNUPDATE" 7 "September 2026" "CoreDNS" "CoreDNS Plugins"
.\" Generated by Mmark Markdown Processer - mmark.miek.nl
.TH "COREDNS-DYNUPDATE" 7 "October 2026" "CoreDNS" "CoreDNS Plugins"
.SH "NAME"
.PP
\fIdynupdate\fP \- accepts authenticated RFC 2136 DNS UPDATE messages for an
explicit, opt\-in authoritative zone.
\fIdynupdate\fP - accepts authenticated RFC 2136 DNS UPDATE messages for an
explicit, opt-in authoritative zone.
.SH "DESCRIPTION"
.PP
The \fIdynupdate\fP plugin serves one writable authoritative zone through the
normal CoreDNS authoritative file implementation and may be used only once
per server block. Use separate server blocks for separate writable zones.
An RFC 1035\-style zone file provides the initial data and is never modified.
An RFC 1035-style zone file provides the initial data and is never modified.
Configure \fB\fCdatabase\fR for a
persistent primary: a successful UPDATE is committed to the local database
before its new snapshot becomes visible or the success response is sent.
@@ -26,7 +26,7 @@ owner name, and RR type. Use \fB\fC*\fR as the owner name or RR type only when t
broader permission is intentional. Configure \fB\fCrequire_opcode UPDATE\fR in the
\fItsig\fP plugin so unsigned UPDATE requests are rejected at the protocol
boundary. UPDATE requests for a different zone receive NOTAUTH; they do not
fall through to query\-only backends. Ordinary queries outside the dynamic
fall through to query-only backends. Ordinary queries outside the dynamic
zone still pass to the next plugin.
.PP
@@ -34,12 +34,12 @@ The implementation supports RFC 2136 prerequisites, add and delete
operations, CNAME and apex SOA/NS invariants, automatic SOA serial updates,
and the current snapshot for AXFR. SOA serial zero is rejected because RFC
2136 recommends avoiding it for interoperability, and automatic increments
skip zero after wraparound. DNSSEC records and related zone\-integrity metadata
skip zero after wraparound. DNSSEC records and related zone-integrity metadata
(\fB\fCSIG\fR, \fB\fCKEY\fR, \fB\fCNXT\fR, \fB\fCDS\fR, \fB\fCRRSIG\fR, \fB\fCNSEC\fR, \fB\fCDNSKEY\fR, \fB\fCNSEC3\fR, \fB\fCNSEC3PARAM\fR,
\fB\fCTALINK\fR, \fB\fCCDS\fR, \fB\fCCDNSKEY\fR, \fB\fCTA\fR, \fB\fCDLV\fR, and \fB\fCZONEMD\fR) are rejected because
the plugin cannot regenerate them after an update. IXFR and automatic DNSSEC
re\-signing are not supported. The plugin is experimental; it does not provide
multi\-primary replication or atomic transactions across zones. Do not expose
re-signing are not supported. The plugin is experimental; it does not provide
multi-primary replication or atomic transactions across zones. Do not expose
the UPDATE service without network controls in addition to TSIG authentication.
.PP
@@ -49,7 +49,7 @@ answers. Other middleware, such as \fIheader\fP, still processes those requests
responses, and unrelated zones remain cacheable. External recursive
caches can still retain old answers until their TTL expires. AXFR requests
pass through \fItransfer\fP and its access controls. Successful changes trigger
best\-effort NOTIFY; bursts are coalesced to one in\-flight notification per zone
best-effort NOTIFY; bursts are coalesced to one in-flight notification per zone
instance.
.SS "PERSISTENCE"
@@ -70,8 +70,8 @@ authenticated UPDATE after startup. This prevents a failed startup from
preserving an obsolete seed. Until that first access, the seed must remain
available; creation errors return SERVFAIL rather than acknowledging an update.
Subsequently, the database, including the SOA serial, is authoritative;
editing or removing the seed does not replace dynamic data. Corrupt, incompatible, wrong\-zone, or
over\-limit databases cause an error, not a fallback to the seed. A failed
editing or removing the seed does not replace dynamic data. Corrupt, incompatible, wrong-zone, or
over-limit databases cause an error, not a fallback to the seed. A failed
commit returns SERVFAIL without publishing the candidate snapshot or serial.
After an abrupt process exit, the database reopens at a committed transaction.
@@ -82,7 +82,7 @@ zone, stop CoreDNS, back up and remove the database, then restart with the
desired seed. If initial creation fails, remove the uninitialized database
before retrying. Do not lower limits below the existing zone's size when
reloading. Database files can retain reusable free pages after records are
deleted; \fB\fCmax_bytes\fR limits live uncompressed DNS data, not on\-disk file size.
deleted; \fB\fCmax_bytes\fR limits live uncompressed DNS data, not on-disk file size.
.SH "SYNTAX"
.PP
@@ -105,9 +105,9 @@ dynupdate [ZONE] {
\fBZONE\fP is the single authoritative zone. If omitted, the server block
must define exactly one zone.
.IP \(bu 4
\fBDBFILE\fP is the RFC 1035\-style seed zone file. A relative path is resolved
\fBDBFILE\fP is the RFC 1035-style seed zone file. A relative path is resolved
below the path configured by the \fIroot\fP plugin. Required, but read only when
initializing a new database or starting in memory\-only mode.
initializing a new database or starting in memory-only mode.
.IP \(bu 4
\fB\fCdatabase\fR is optional. \fBPATH\fP is a local database file, also resolved
relative to \fIroot\fP. The database is created with mode 0600 on systems that
@@ -135,7 +135,7 @@ Limits must be positive integers. Requests exceeding the configured limits
are refused atomically with REFUSED; seed or stored data above the zone limits
is rejected during startup. Updates are serialized and rebuild the bounded
zone snapshot, so this backend is intended for small dynamic zones, not
high\-volume bulk loading.
high-volume bulk loading.
.PP
At least one \fB\fCallow\fR rule is required. The plugin owns the configured zone;
@@ -145,7 +145,7 @@ independent behavior is explicitly intended.
.SH "EXAMPLES"
.PP
For temporary ACME challenge records, load a seed zone and permit one key to
update TXT records at the challenge owner. This example uses memory\-only mode.
update TXT records at the challenge owner. This example uses memory-only mode.
Generate a private key for your deployment; the example secret is public.
.PP
@@ -206,7 +206,7 @@ ns 60 IN A 192.0.2.53
.RE
.PP
With a BIND\-format TSIG key file, \fB\fCnsupdate -k update.key\fR can submit:
With a BIND-format TSIG key file, \fB\fCnsupdate -k update.key\fR can submit:
.PP
.RS
@@ -225,7 +225,7 @@ send
Use \fB\fCnsupdate -v -k update.key\fR for TCP. Query \fB\fChost.example.org. A\fR directly
on this server to see the change. With \fB\fCdatabase\fR configured it remains after
restart. For DHCP forward and reverse updates, configure each zone in its own
server block with its own seed, database and least\-privilege \fB\fCallow\fR rules.
server block with its own seed, database and least-privilege \fB\fCallow\fR rules.
The DHCP server remains responsible for lease expiry, record cleanup, and
coordinating its forward and reverse requests.
@@ -240,7 +240,7 @@ separate transactions: a rejected reverse update does not undo a successful
forward update.
.PP
For a DHCP\-managed \fB\fChost.example.org.\fR at \fB\fC192.0.2.10\fR, the forward\-zone
For a DHCP-managed \fB\fChost.example.org.\fR at \fB\fC192.0.2.10\fR, the forward-zone
rule can be:
.PP
@@ -287,10 +287,10 @@ go test ./plugin/dynupdate \-run '^$' \-bench '^BenchmarkUpdate$' \-benchmem \-c
.RE
.PP
The Kea test supplies synthetic lease\-change notifications to a real D2
The Kea test supplies synthetic lease-change notifications to a real D2
process and verifies IPv4 and IPv6 forward/reverse creation, renewal,
ownership conflicts, removal, and name reuse. It is not a DHCP address
allocation, lease\-expiration, or physical\-network test. Missing client
allocation, lease-expiration, or physical-network test. Missing client
binaries skip the corresponding local tests; Linux CI installs both.
Distribution confinement may require approved paths for the Kea test
process. \fB\fCCOREDNS_KEA_CONFIG_DIR\fR, \fB\fCKEA_PIDFILE_DIR\fR, and \fB\fCKEA_LOCKFILE_DIR\fR
@@ -299,16 +299,16 @@ keep Ubuntu's AppArmor policy enabled. Do not point a test at runtime
directories used by a live Kea service.
.PP
The benchmark changes a record in 100\-, 1000\-, and 10000\-record zones,
The benchmark changes a record in 100-, 1000-, and 10000-record zones,
with and without synchronous persistence and four concurrent query workers.
\fB\fCns/op\fR measures one protocol\-engine transaction, excluding transport and
\fB\fCns/op\fR measures one protocol-engine transaction, excluding transport and
TSIG verification, while the query metrics report concurrent query latency
and throughput. Allocations include the query workers when
enabled. Measure on the filesystem and hardware used for deployment:
updates rebuild the entire zone and queries can wait for the update and
disk commit. The record limits bound accepted data, not update latency or
peak process memory. This backend is intended for small, infrequently
updated zones, not a high\-throughput DHCP service.
updated zones, not a high-throughput DHCP service.
.SH "SEE ALSO"
.PP
@@ -317,10 +317,10 @@ AXFR/NOTIFY, and TSIG authentication configuration.
.IP \(bu 4
RFC 2136
\[la]https://www.rfc-editor.org/rfc/rfc2136\[ra] defines DNS UPDATE.
\[la]https://www.rfc-editor.org/info/rfc2136/\[ra] defines DNS UPDATE.
.IP \(bu 4
RFC 1982
\[la]https://www.rfc-editor.org/rfc/rfc1982\[ra] defines DNS serial
\[la]https://www.rfc-editor.org/info/rfc1982/\[ra] defines DNS serial
number arithmetic.