COREDNS-CLOUDDNS(7)

💜 clouddns — COREDNS-CLOUDDNS(7) 💜

okay bestie, so this is a page from the CoreDNS Plugins manual set — like, the whole COREDNS-CLOUDDNS(7) situation — and no cap, it's lowkey one of the cutest little plugins to explain. buckle up 🎀

---

✨ NAME ✨

clouddns — enables serving zone data from GCP Cloud DNS. that's it, that's the vibe 💅

---

🌈 DESCRIPTION 🌈

so the clouddns plugin is genuinely iconic for serving zones straight from resource record sets in GCP Cloud DNS. and the way it supports all Google Cloud DNS records ⟨https://cloud.google.com/dns/docs/overview#supported_dns_record_types⟩? obsessed. every single record type, we love to see it 🫶

here's the tea though: you can use this plugin whenever CoreDNS is deployed on GCP or literally anywhere else. it's giving main character energy in any environment ✨

just know that this plugin accesses the resource records through the Google Cloud API. that's the whole route, iykyk.

and for records in a privately hosted zone? bestie, you do not need to place CoreDNS and this plugin in the associated VPC network. nope. in fact — the private hosted zone could be created without any associated VPC at all, and this plugin could still access the resource records under the hosted zone. slay 💀✨

---

🦋 SYNTAX 🦋

clouddns [ZONE:PROJECT_ID:HOSTED_ZONE_NAME...] {
    credentials [FILENAME]
    fallthrough [ZONES...]
}

• 🌸 ZONE — the name of the domain to be accessed. and here's the important bit: when there are multiple zones with overlapping domains (private vs. public hosted zone), CoreDNS does the lookup in the order you list them here. so for a non-existing resource record, the SOA response will come from the rightmost zone. order matters, periodt.
• 🌸 PROJECT_ID — the project ID of the Google Cloud project.
• 🌸 HOSTED_ZONE_NAME — the name of the hosted zone that contains the resource record sets to be accessed.
• 🌸 credentials — used for reading the credential file from FILENAME (normally a .json file). this field is optional. if you don't provide it, authentication will be done automatically, e.g., through the environmental variable GOOGLE_APPLICATION_CREDENTIALS. 🫧

⚠️ okay, real talk moment: CoreDNS validates that the given file has a valid credentials type, but it does not validate the credentials file for malicious input. so keep your eyes on that file, bestie. 🙈 please see Google Cloud's authentication method ⟨https://cloud.google.com/docs/authentication⟩ and validating credential configurations from external sources ⟨https://docs.cloud.google.com/docs/authentication/client-libraries#external-credentials⟩ for more details.

• 🌸 fallthrough — if the zone matches and no record can be generated, pass the request to the next plugin. if [ZONES...] is omitted, then fallthrough happens for all zones for which the plugin is authoritative. if specific zones are listed (for example in-addr.arpa and ip6.arpa), then only queries for those zones will be subject to fallthrough. the way that works is honestly so clean ✨

---

🎀 EXAMPLES 🎀

💖 enable clouddns with implicit GCP credentials and resolve CNAMEs via 10.0.0.1:

example.org {
    clouddns example.org.:gcp-example-project:example-zone
    forward . 10.0.0.1
}

💖 enable clouddns with fallthrough:

example.org {
    clouddns example.org.:gcp-example-project:example-zone example.com.:gcp-example-project:example-zone-2 {
        fallthrough example.gov.
    }
}

💖 enable clouddns with multiple hosted zones with the same domain:

. {
    clouddns example.org.:gcp-example-project:example-zone example.com.:gcp-example-project:other-example-zone
}

---

👑 and that's the whole page, bestie! this one's from the CoreDNS manual, March 2026 edition — COREDNS-CLOUDDNS(7), no cap. go forth and serve those zones 💜✨🎀