COREDNS-CACHE(7)

💅 COREDNS-CACHE(7) — the cache plugin, explained bestie to bestie 🎀

okay so this is the cache plugin page from the CoreDNS Plugins manual, and honestly? it's a banger. let's get into it ✨

---

✨ NAME ✨

cache — bestie, it enables a frontend cache. that's the whole vibe. 💖

---

🌸 DESCRIPTION 🌸

so when cache is enabled, all records except zone transfers and metadata records get cached for up to 3600s. caching is mostly useful in a scenario when fetching data from the backend (upstream, database, etc.) is expensive — like, why make the backend do all that work every single time when you could simply not? 💅

cache will pass DNSSEC (DNSSEC OK; DO) options through the plugin for upstream queries. slay.

⚠️ this plugin can only be used once per Server Block. one. per. block. no cap. 🫶

---

✨ SYNTAX ✨

cache [TTL] [ZONES...]

• TTL — max TTL in seconds. if you don't specify it, the maximum TTL gets used, which is 3600 for NOERROR responses and 1800 for denial of existence ones. so setting a TTL of 300: cache 300 would cache records up to 300 seconds. 🕐
• ZONES — the zones it should cache for. if empty, the zones from the configuration block are used. iykyk.

each element in the cache is cached according to its TTL (with TTL as the max). and like, note that TTL only caps the cache duration and does not extend it. a record with a 30s TTL will still be cached for 30s even with cache 600 — the vibes are capped, not stretched, periodt. the minimum cache duration defaults to 5 seconds and can be adjusted per cache type using MINTTL in the success or denial directives. 🦋

a cache is divided into 256 shards, each holding up to 39 items by default — for a total size of 256 * 39 = 9984 items. math ate. 🔥

if you want more control (and honestly, who doesn't):

cache [TTL] [ZONES...] {
    success CAPACITY [TTL] [MINTTL]
    denial CAPACITY [TTL] [MINTTL]
    prefetch AMOUNT [[DURATION] [PERCENTAGE%]]
    serve_stale [DURATION] [REFRESH_MODE]
    servfail DURATION
    disable success|denial [ZONES...]
    keepttl
}

• TTL and ZONES — as above. 💖
• success — override the settings for caching successful responses. CAPACITY indicates the maximum number of packets we cache before we start evicting (randomly). TTL overrides the cache maximum TTL. MINTTL overrides the cache minimum TTL (default 5), which can be useful to limit queries to the backend. ✨
• denial — override the settings for caching denial of existence responses. CAPACITY indicates the maximum number of packets we cache before we start evicting (LRU). TTL overrides the cache maximum TTL. MINTTL overrides the cache minimum TTL (default 5), which can be useful to limit queries to the backend. also there's a third category (error) but those responses are never cached. not even invited to the party. 💀
• prefetch — will prefetch popular items when they are about to be expunged from the cache. "popular" means AMOUNT queries have been seen with no gaps of DURATION or more between them. DURATION defaults to 1m. prefetching will happen when the TTL drops below PERCENTAGE, which defaults to 10%, or latest 1 second before TTL expiration. values should be in the range [10%, 90%]. note the percent sign is mandatory — yes, really. PERCENTAGE is treated as an int. concurrent requests that trigger a prefetch for the same cache entry dispatch at most one background fetch, so prefetch load scales with the number of distinct eligible entries rather than request rate. icon behavior. 👑
• serve_stale — when serve_stale is set, cache will always serve an expired entry to a client if there is one available, as long as it has not been expired for longer than DURATION (default 1 hour). by default, the cache plugin will attempt to refresh the cache entry after sending the expired cache entry to the client. the responses have a TTL of 0. REFRESH_MODE controls the timing of the expired cache entry refresh:
  • verify will first verify that an entry is still unavailable from the source before sending the expired entry to the client.
  • immediate will immediately send the expired entry to the client before checking to see if the entry is available from the source.

REFRESH_MODE defaults to immediate. setting this value to verify can lead to increased latency when serving stale responses, but will prevent stale entries from ever being served if an updated response can be retrieved from the source. in immediate mode, concurrent requests for the same expired entry dispatch at most one background refresh. 🌈

• servfail — cache SERVFAIL responses for DURATION. setting DURATION to 0 will disable caching of SERVFAIL responses. if this option is not set, SERVFAIL responses will be cached for 5 seconds. DURATION may not be greater than 5 minutes. 🫶
• disable — disable the success or denial cache for the listed ZONES. if no ZONES are given, the specified cache will be disabled for all zones. bye bestie 👋
• keepttl — do not age TTL when serving responses from cache. the entry will still be removed from cache when the TTL expires as normal, but until it expires responses will include the original TTL instead of the remaining TTL. this can be useful if CoreDNS is used as an authoritative server and you want to serve a consistent TTL to downstream clients.

🚨 this is NOT recommended when CoreDNS is caching records it is not authoritative for, because it could result in downstream clients using stale answers. like, genuinely do not, fr fr. 😭

---

🧚 CAPACITY AND EVICTION 🧚

if CAPACITY is not specified, the default cache size is 9984 per cache. the minimum allowed cache size is 1024. if CAPACITY is specified, the actual cache size used will be rounded down to the nearest number divisible by 256 (so all shards are equal in size). equality, we love to see it. 💅

eviction is done per shard. in effect, when a shard reaches capacity, items are evicted from that shard. since shards don't fill up perfectly evenly, evictions will occur before the entire cache reaches full capacity. each shard capacity is equal to the total cache size / number of shards (256). eviction is <random>, not TTL based. entries with 0 TTL will remain in the cache until randomly evicted when the shard reaches capacity. chaotic but valid, honestly. 🎲

---

⭐ METRICS ⭐

if monitoring is enabled (via the prometheus plugin) then the following metrics are exported:

• coredns_cache_entries{server, type, zones, view} — total elements in the cache by cache type.
• coredns_cache_hits_total{server, type, zones, view} — counter of cache hits by cache type.
• coredns_cache_misses_total{server, zones, view} — counter of cache misses. Deprecated, derive misses from cache hits/requests counters.
• coredns_cache_requests_total{server, zones, view} — counter of cache requests.
• coredns_cache_prefetch_total{server, zones, view} — counter of times the cache has prefetched a cached item.
• coredns_cache_drops_total{server, zones, view} — counter of responses excluded from the cache due to request/response question name mismatch.
• coredns_cache_served_stale_total{server, zones, view} — counter of requests served from stale cache entries.
• coredns_cache_evictions_total{server, type, zones, view} — counter of cache evictions.

cache types are either "denial" or "success". Server is the server handling the request — see the prometheus plugin for documentation. 🌸

---

💖 EXAMPLES 💖

enable caching for all zones, but cap everything to a TTL of 10 seconds:

. {
    cache 10
    whoami
}

proxy to Google Public DNS and only cache responses for example.org (or below). iconic combo:

. {
    forward . 8.8.8.8:53
    cache example.org
}

enable caching for example.org, keep a positive cache size of 5000 and a negative cache size of 2500:

example.org {
    cache {
        success 5000
        denial 2500
    }
}

enable caching for example.org, but do not cache denials in sub.example.org:

example.org {
    cache {
        disable denial sub.example.org
    }
}

---

and that's the whole page, bestie!! 🌈💜 this was CoreDNS, from October 2026 — go forth and cache responsibly, mwah 🫶💅✨🎀