When DNS Blinks: Scaling and Hardening CoreDNS in Critical Cloud Infrastructure#

Yong Tang, Ivanti & John Belamaric, Google

• Why: Framed against the recent DNS disruptions at major cloud providers. The argument is that DNS is critical infrastructure and brief degradation cascades — which is exactly the failure mode that makes DNS a networking problem rather than an application one.
• What: How CoreDNS is evolving for large-scale critical environments, covering both scale and security.
• How: New CoreDNS plugins that improve multi-core scalability and reduce contention under high query load; operational lessons on tuning, deployment patterns and limiting blast radius during failure. The security half covers spoofing, cache abuse and amplification attacks, reviews recently fixed CoreDNS vulnerabilities, and gives hardening strategies.
• Where applicable: Any cluster running CoreDNS at load, which is nearly all of them. The contention work matters most on high-core-count nodes.