COREDNS-BIND(7)

💅 COREDNS-BIND(7) — the bind plugin, explained bestie to bestie

okay so this is coredns-bind, straight out of the CoreDNS Plugins manual, and honestly? it's the glow-up your listener didn't know it needed. let's get into it ✨

---

🌸 NAME

bind — overrides the host to which the server should bind.

like, it picks where your server sits. main character relocation energy 👑

---

🦋 DESCRIPTION

So normally? the listener binds to the wildcard host. that's the default vibe. but sometimes you're like "no bestie, I want this thing on a specific IP instead," and that's literally what bind is for 💖

If several addresses are provided, a listener will be open on each of the IP provided. one per IP, no cap.

Each address has to be an IP or name of one of the interfaces of the host. Bind by interface name, binds to the IPs on that interface at the time of startup or reload — and just so you know, reload will happen with a SIGHUP or if the config file changes. so it re-checks itself, iconic behavior honestly 🌈

And here's the cute part: if the given argument is an interface name, and that interface has several IP addresses, CoreDNS will listen on all of the interface IP addresses (including IPv4 and IPv6). all of them. it ate and left no crumbs 🍓

---

✨ SYNTAX

In its basic form, a simple bind uses this syntax:

bind ADDRESS|IFACE  ...

You can also exclude some addresses with their IP address or interface name in expanded syntax:

bind ADDRESS|IFACE ... {
    except ADDRESS|IFACE ...
}

• ADDRESS|IFACE — an IP address or interface name to bind to. When several addresses are provided a listener will be opened on each of the addresses. please read the Description for more details 🫶
• except — excludes interfaces or IP addresses to bind to. the except option only excludes addresses for the current bind directive if multiple bind directives are used in the same server block. iykyk, it's scoped 👑

---

💜 EXAMPLES

To make your socket accessible only to that machine, bind to IP 127.0.0.1 (localhost):

. {
    bind 127.0.0.1
}

To allow processing DNS requests only local host on both IPv4 and IPv6 stacks, use the syntax:

. {
    bind 127.0.0.1 ::1
}

If the configuration comes up with several bind plugins, all addresses are consolidated together — the following sample is equivalent to the preceding one:

. {
    bind 127.0.0.1
    bind ::1
}

The following server block binds on localhost with its interface name (both 127.0.0.1 and ::1):

. {
    bind lo
}

You can exclude some addresses by their IP or interface name — and the following will only listen on ::1 or whatever addresses have been assigned to the lo interface:

. {
    bind lo {
        except 127.0.0.1
    }
}

---

💀 BUGS

🚨 AVOIDING LISTENER CONTENTION

TL;DR: when adding the bind plugin to a server block, it must also be added to all other server blocks that listen on the same port. all of them. no exceptions bestie 😭

When more than one server block is configured to listen to a common port, those server blocks must either all use the bind plugin, or all use default binding (no bind plugin). Note that "port" here refers to the TCP/UDP port that a server block is configured to serve (default 53) — not a network interface. important distinction, don't get it twisted 💅

For two server blocks listening on the same port, if one uses the bind plugin and the other does not, two separate listeners will be created that will contend for serving packets destined to the same address. Doing so will result in unpredictable behavior (requests may be randomly served by either server). yeah. random. chaos. not the cute kind 🙈

This happens because without the bind plugin, a server will bind to all interfaces, and this will collide with another server if it's using bind to listen to an address on the same port.

For example, the following creates two servers that both listen on 127.0.0.1:53, which would result in unpredictable behavior for queries in a.bad.example.com:

a.bad.example.com {
    bind 127.0.0.1
    forward . 1.2.3.4
}

bad.example.com {
    forward . 5.6.7.8
}

fr fr, if you're mixing bind and no-bind across server blocks on the same port, just don't. unpredictable behavior is not the aesthetic 🔥

---

kisses and see-you-laters 💋 — this masterpiece of a manual page was brought to you by CoreDNS, dated March 2026 (yes, from the future, we're just that ahead of the game). go bind responsibly 🎀🦋✨