COREDNS-ACL(7)

🌸 COREDNS-ACL(7) — the acl plugin, explained by your favorite Unix girlie 🌸

ok so this is the manual page for acl, one of the CoreDNS plugins (yes, CoreDNS Plugins is the whole family, hi 💖). Pull up a chair bestie, we're doing access control today.

---

✨ NAME ✨

acl — it enforces access control policies on source ip and prevents unauthorized access to DNS servers. that's it, that's the vibe check. 🛡️

---

💅 DESCRIPTION 💅

okay so with acl enabled, you can block or filter suspicious DNS queries by configuring IP filter rule sets — like, allowing the authorized queries and blocking the unauthorized ones. literally a bouncer for your DNS. 🚪✨

When evaluating the rule sets, acl uses the source IP of the TCP/UDP headers of the DNS query received by CoreDNS. and ngl this is the part people get confused about, so listen up: this source IP will be different than the IP of the client originating the request in cases where the source IP of the request is changed in transit. for example:

• if the request passes though an intermediate forwarding DNS server or recursive DNS server before reaching CoreDNS
• if the request traverses a Source NAT before reaching CoreDNS

so yeah, it's giving "whoever's handing me the packet" not "whoever started the whole thing." 😭

Also: this plugin can be used multiple times per Server Block. slay. 👑

---

🎀 SYNTAX 🎀

acl [ZONES...] {
    ACTION [type QTYPE...] [net SOURCE...]
}

• ZONES — zones it should be authoritative for. If empty, the zones from the configuration block are used.
• ACTION — can be allow, block, filter, or drop, and it defines the way to deal with DNS queries matched by this rule. The default action is allow, which means a DNS query not matched by any rules will be allowed to recurse. The difference between block and filter is that block returns status code of REFUSED while filter returns an empty set NOERROR. drop however returns no response to the client — literally leaves them on read 💀.
• QTYPE — the query type to match for the requests to be allowed or blocked. Common resource record types are supported. * stands for all record types. The default behavior for an omitted type QTYPE... is to match all kinds of DNS queries (same as type *).
• SOURCE — the source IP address to match for the requests to be allowed or blocked. Typical CIDR notation and single IP address are supported. * stands for all possible source IP addresses.

---

🔥 EXAMPLES 🔥

To demonstrate the usage of plugin acl, here we provide some typical examples. it's a little buffet of configurations, take what you need bestie 🍓

Block all DNS queries with record type A from 192.168.0.0/16：

. {
    acl {
        block type A net 192.168.0.0/16
    }
}

Filter all DNS queries with record type A from 192.168.0.0/16：

. {
    acl {
        filter type A net 192.168.0.0/16
    }
}

Block all DNS queries from 192.168.0.0/16 except for 192.168.1.0/24：

. {
    acl {
        allow net 192.168.1.0/24
        block net 192.168.0.0/16
    }
}

Allow only DNS queries from 192.168.0.0/24 and 192.168.1.0/24：

. {
    acl {
        allow net 192.168.0.0/24 192.168.1.0/24
        block
    }
}

Block all DNS queries from 192.168.1.0/24 towards a.example.org：

example.org {
    acl a.example.org {
        block net 192.168.1.0/24
    }
}

Drop all DNS queries from 192.0.2.0/24：

. {
    acl {
        drop net 192.0.2.0/24
    }
}

---

📊 METRICS 📊

If monitoring is enabled (via the prometheus plugin) then the following metrics are exported — it's giving observability, we love to see it ✨

• coredns_acl_blocked_requests_total{server, zone, view} — counter of DNS requests being blocked.
• coredns_acl_filtered_requests_total{server, zone, view} — counter of DNS requests being filtered.
• coredns_acl_allowed_requests_total{server, view} — counter of DNS requests being allowed.
• coredns_acl_dropped_requests_total{server, zone, view} — counter of DNS requests being dropped.

The server and zone labels are explained in the metrics plugin documentation. go read that one next, iykyk 🦋

---

ok that's the whole page!! no cap, you now know acl better than most people. go filter something (responsibly) 💜

signing off — this was CoreDNS, March 2026 edition, straight from the CoreDNS plugin docs squad 🫶🎀