COREDNS-K8S_EXTERNAL(7)

💅 k8s_external — CoreDNS plugin (manual page COREDNS-K8S_EXTERNAL(7))

okay so bestie, welcome to the k8s_external page from the CoreDNS plugins manual ✨ this one is all about resolving the load balancer and external IPs from outside your Kubernetes clusters, and — if you flip the right switch — headless services too 🎀

---

🌸 NAME 🌸

k8s_external — resolves load balancer, external IPs from outside Kubernetes clusters and if enabled headless services.

---

🦋 DESCRIPTION 🦋

So this plugin gives you an additional zone that resolves the external IP address(es) of a Kubernetes service, plus headless services. The catch? It's only useful if the kubernetes plugin is also loaded. Like, they're a package deal, iykyk 💖

The plugin uses an external zone to resolve in-cluster IP addresses. It only handles queries for A, AAAA, SRV, and PTR records — and to make it a proper DNS zone, it handles SOA and NS queries for the apex of the zone. No cap, that's the whole roster 📋

By default the apex of the zone will look like the following (assuming the zone used is example.org):

example.org.    5 IN    SOA ns1.dns.example.org. hostmaster.example.org. (
                12345      ; serial
                7200       ; refresh (2 hours)
                1800       ; retry (30 minutes)
                86400      ; expire (1 day)
                5          ; minimum (5 seconds)
                )
example.org        5 IN    NS ns1.dns.example.org.

ns1.dns.example.org.  5 IN  A    ....
ns1.dns.example.org.  5 IN  AAAA ....

Note that we use the dns subdomain for the records DNS needs (see the apex directive). Also note the SOA's serial number is static — it does not move, it does not slay, it just sits there 💀

The IP addresses of the nameserver records are those of the CoreDNS service.

The k8s_external plugin handles the subdomain dns and the apex of the zone itself; all other queries are resolved to addresses in the cluster. periodt 🫶

---

✨ SYNTAX ✨

k8s_external [ZONE...]

• ZONES — the zones k8s_external should be authoritative for.

If you want to change the apex domain or use a different TTL for the returned records you can use this extended syntax 👑

k8s_external [ZONE...] {
    apex APEX
    ttl TTL
}

• APEX — the name (DNS label) to use for the apex records; it defaults to dns.
• ttl — lets you set a custom TTL for responses. The default is 5 (seconds).

If you want to enable headless service resolution, you can do so by adding the headless option 🧚

k8s_external [ZONE...] {
    headless
}

• if there is a headless service with external IPs set, external IPs will be resolved

If the queried domain does not exist, you can fall through to the next plugin by adding the fallthrough option 🍓

k8s_external [ZONE...] {
    fallthrough [ZONE...]
}

---

🔥 EXAMPLES 🔥

Enable names under example.org to be resolved to in-cluster DNS addresses.

. {
   kubernetes cluster.local
   k8s_external example.org
}

With the Corefile above, the following Service will get an A record for test.default.example.org with the IP address 192.168.200.123 🌈

apiVersion: v1
kind: Service
metadata:
 name: test
 namespace: default
spec:
 clusterIP: None
 externalIPs:
 - 192.168.200.123
 type: ClusterIP

The k8s_external plugin can be used in conjunction with the transfer plugin to enable zone transfers. Notifies are not supported. 🚫

. {
    transfer example.org {
        to *
    }
    kubernetes cluster.local
    k8s_external example.org
}

With the fallthrough option, if the queried domain does not exist, it will be passed to the next plugin that matches the zone.

. {
   kubernetes cluster.local
   k8s_external example.org {
     fallthrough
   }
   forward . 8.8.8.8
}

For some background see resolve external IP address ⟨https://github.com/kubernetes/dns/issues/242⟩. And A records for services with Load Balancer IP ⟨https://github.com/coredns/coredns/issues/1851⟩ 📚

---

lowkey a vibe check before you ship: this plugin is only useful if the kubernetes plugin is also loaded, so don't come for me if it's giving nothing without it 🙈

---

💜 that's the whole page, bestie 💜 courtesy of CoreDNS, dated March 2026 — go forth and resolve those external IPs, you absolute icon 👑✨