A CoreDNS plugin to handle split dns
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Adphi 9acfa9c34e
Fix example
1 month ago
.github Create dependabot.yml 1 month ago
.gitignore naive implementation 8 months ago
LICENSE bootstrap from example 8 months ago
README.md Fix example 1 month ago
example.org add fallback nameserver, rework configuration 1 month ago
go.mod add fallback nameserver, rework configuration 1 month ago
go.sum add fallback nameserver, rework configuration 1 month ago
metrics.go go module setup, rename example as split 8 months ago
ready.go naive implementation 8 months ago
setup.go add fallback nameserver, rework configuration 1 month ago
setup_test.go naive implementation 8 months ago
split.go add fallback nameserver, rework configuration 1 month ago
split_test.go naive implementation 8 months ago




split - Filter DNS Server response Records based on network definitions and request source IP.


The split plugin allows filtering DNS Server responses Records based on network definitions. That way you do not need to run multiple DNS servers to handle split DNS.

If there are multiple A Records in the response, only the records matching the defined network will be returned to a matching querier, and the records not matching the network to the other sources.

This plugin is not much about security, it is designed only to give a better answer to the incoming source IP, if you need to apply security filtering rules, please consider using the coredns acl plugin.


This package will always be compiled as part of CoreDNS and not in a standalone way. It will require you to use go get or as a dependency on plugin.cfg.

The manual will have more information about how to configure and extend the server with external plugins.

A simple way to consume this plugin, is by adding the following on plugin.cfg, and recompile it as detailed on coredns.io.


Put this higher in the plugin list, so that split is before after any of the other plugins.

After this you can compile coredns by:

go generate
go build

Or you can instead use make:



# TODO: docs


This plugin reports readiness to the ready plugin. It will be immediately ready.


In this configuration, we forward all queries to and to if did not respond.

If only used with the forward plugin, the private dns server must be configured as the first forwarded server in the list. The policy must be configured as sequential, so that the first server is always tried first and the second only if the first do not return any answer.

We filter out A records pointing to an IP address in the network except for queries coming from the and networks. If the allowed networks are not defined, the plugin will allow the requests from the same network, e.g.

If the record exists both as public and private, the private record will be filtered, resulting with no records at all. So you can provide a fallback server that will be used to get the public record.

. {
  split {
    net allow
    net # implicitely: allow
  # we could also use any records source
  # e.g.: file example.org
  forward . {
    policy sequential

Also See

See the manual.