ExternalDNS

Networking

Configures external DNS servers from Kubernetes resources

kubernetes-sigs/external-dns Documentation

v0.23.0Sep 18, 202629 days after v0.22.0

View on GitHub

v0.23.0

Sep 18, 2026Compare GitHub

General information

It's recommended to try this version with --dry-run=true first, see upgrade instructions.

Action required before upgrade

:warning: crd Registry now stores DNSRecord objects independantly of source namespace (#6606).
- Upgrading from v0.22.0: set --crd-registry-namespace accordingly.
:warning: With --txt-encrypt-enabled, Go 1.27 changed gzip output (#6675):
- :information_source: External DNS has been updated to avoid mismatch (#6680)
- :information_source: Encryption recommendations have been detailed

Important

:information_source: --enable-legacy-annotation-prefix allows reading also external-dns.alpha.kubernetes.io/ annotations during migration started since v0.22.0 (#6703).
:information_source: --dry-run is now honored by ns1 (#6693) and alibabacloud (#6699).
:information_source: On DNSEndpoint, cloudflare providerSpecific names are now prefix-free (#6731).
- Annotation-style names (external-dns.alpha.kubernetes.io/cloudflare-*, external-dns.kubernetes.io/cloudflare-*) still work but are deprecated.
:information_source: In-tree Gandi provider removed (#6654). Use a previous version or a webhook provider.
:information_source: For security & reliability, webhook bodies are capped at 32 MiB
- configurable with --webhook-provider-max-body-size (#6484).

:warning: Breaking Changes

[registry] add --crd-registry-namespace by @mloiseleur in #6606
remove unmaintained provider gandi by @ivankatliarchuk in #6654
[webhook] bound request and response body sizes by @mloiseleur in #6484

:rocket: Features

[cloudflare] support TLSA records by @oscrx in #6616
[docker] FIPS 140-3 image build target and docs by @ivankatliarchuk in #6657
[source] migrate gateway sources to indexer-based filtering by @ivankatliarchuk in #6545

:bug: Bug fixes

[alibabacloud] deduplicate hosted zones before fetching records by @pujitha24 in #6711
[alibabacloud] respect dry-run for record updates and deletes by @vflaux in #6699
[annotations] add --enable-legacy-annotation-prefix migration flag by @pnz1990 in #6703
[cloudflare] normalize provider-specific property names at ingestion by @mloiseleur in #6731
[cloudflare] pin cloudflare-go v7.7.0 by @mloiseleur in #6660
[ns1] respect --dry-run flag by @yohboy in #6693
[oci] set useragent, record call limit by @tfountain in #6597
[pdns] add request timeout and context cancellation for PowerDNS API calls by @zanarellidev in #6694
[registry] delete TXT records with their stored value by @mloiseleur in #6680
[rfc2136] do not swallow AXFR envelope errors by @lhp-nemlig in #6652
[source] collect annotation hostnames before FQDN template by @zanarellidev in #6644
[source/crd] apply the annotation filter outside the cache transform by @mloiseleur in #6730
[source] evaluate FQDN templates on typed objects like unstructured by @zanarellidev in #6611
[source] return errors for invalid label/annotation filters in NewSourceConfig by @ivankatliarchuk in #6610
[source] skip endpoints with DNS labels over 63 chars in node and pod sources by @immanuwell in #6653

:memo: Documentation

add the Akamai Edge DNS webhook provider to the registry by @PixiBixi in #6685
[contributing] add comment style and error-handling guidance by @ivankatliarchuk in #6717
document TXT encryption risks and recommendations by @ivankatliarchuk in #6678
[faq] scope the access annotation to the Service source by @oscrx in #6624
fix typo in AWS IRSA tutorial by @mrchatam in #6726
[flags] correct --default-targets scope in help text by @mloiseleur in #6659
update staging image link in release notes by @Raffo in #6648
[webhook] add Infoblox UDDI provider by @rorychatterton in #6737

:package: Docker Image

docker pull registry.k8s.io/external-dns/external-dns:v0.23.0

:package: Others

<details><summary>chore</summary>

[lint] extract repeated strings to constants for goconst by @ivankatliarchuk in #6696
[release] updates kustomize & docs with v0.22.0 by @mloiseleur in #6645

</details>

[release] make the generated changelog readable by @mloiseleur in #6647
[source] drop embedded field type in pod test literal by @mloiseleur in #6692

</details>

bump github.com/stretchr/testify from 1.12.0 to 1.12.1 in the dev-dependencies group by @app/dependabot in #6649
bump mkdocs-git-revision-date-localized-plugin from 1.5.3 to 1.5.4 in /docs/scripts in the mkdocs-deps group by @app/dependabot in #6667
bump the dev-dependencies group with 14 updates by @app/dependabot in #6664
bump the dev-dependencies group with 14 updates by @app/dependabot in #6738
bump the dev-dependencies group with 17 updates by @app/dependabot in #6720
bump the dev-dependencies group with 21 updates by @app/dependabot in #6700
bump the dev-dependencies group with 3 updates by @app/dependabot in #6668
bump the dev-dependencies group with 3 updates by @app/dependabot in #6690
bump the dev-dependencies group with 4 updates by @app/dependabot in #6669
migrate to Go 1.27.0 by @ivankatliarchuk in #6675

</details>

<details><summary>refactor</summary>

[provider] drop AWS SDK dependency from ZoneTypeFilter by @KR-Ravindra in #6707
[rfc2317] reduce CIDR conversion complexity by @loglapa in #6687

</details>

[controller] poll for the first reconcile in TestRun instead of a fixed sleep by @nikolauspschuetz in #6630
[provider/aws] cover repeated reconcile loops over the alias path by @thc1006 in #6640

</details>

v0.22.0

Aug 20, 2026Compare GitHub

General information

Action required before upgrade

:warning: The default annotation prefix is now external-dns.kubernetes.io/ with no fallback (#6424)
- :rotating_light: This change can delete all your DNS records.
- :information_source: You can either migrate your annotations or set --annotation-prefix=external-dns.alpha.kubernetes.io/.
- :arrow_right: It's recommended to try this version with --dry-run=true, see recommended upgrade instructions.
- :warning: --dry-run is not preventing changes to happen with ns1 & alibaba cloud providers
:warning: To avoid any unwanted DNS records deletion from the annotation prefix change, --policy is now required with no default (#6508).

Important

:warning: CRD/API upgrades: Gateway API TLSRoute now uses v1, standard channel since Gateway API v1.5.0 (#6367). Ambassador Host now uses getambassador.io/v3alpha1 (#6482). Pi-hole v5 API is removed, v6+ only (#6406).
:information_source: On AWS, ownership TXT records for A ALIAS now use the a- prefix (#6523). Migration is automatic and ownership is preserved
- Leftover cname- records can be cleaned with scripts/aws-cleanup-legacy-txt-records.py --alias-cname-cleanup.
:information_source: This release removes in-tree support for Akamai, Plural & Transip (#6485).
- Users needing those providers can use a previous version of ExternalDNS or a webhook-based provider. Gandi is marked for removal (#6634).
:information_source: New: crd registry as an alternative to TXT (#5372)
:information_source: DNAME record support (#6553), and --rfc2136-axfr replacing the deprecated --rfc2136-tsig-axfr (#6598).
:information_source: Guide on how to safely upgrade External-DNS

:warning: Breaking Changes

[annotations] switch default annotations prefix to GA by @mloiseleur in #6424
[config] require explicit --policy flag by @mloiseleur in #6508
[provider/pihole] drop Pi-hole v5 API support by @ivankatliarchuk in #6406
[registry/txt] use a- prefix for AWS A ALIAS ownership TXT records by @mloiseleur in #6523
remove unmaintained providers (akamai, plural, transip) by @mloiseleur in #6485
[source/gateway-api] migrate TLSRoute to v1 by @ecray in #6367

:rocket: Features

add DNAME record type support by @clwluvw in #6553
add isSource template function to scope --fqdn-template by source by @ivankatliarchuk in #6625
[aws] add aws-hosted-zone-id annotation to pin records to a specific zone by @namnt2307 in #6559
[aws] support alias=A and alias=AAAA to create single record type by @u-kai in #5997
[endpoint] support multiple RefObjects per endpoint and per event by @ivankatliarchuk in #6495
[registry] new CRD option by @mloiseleur in #5372
[rfc2136] add --rfc2136-axfr, deprecate --rfc2136-tsig-axfr by @mloiseleur in #6598
[source] add --fqdn-* flag support to f5-virtualserver and f5-transportserver sources by @ivankatliarchuk in #6470
[source] add --fqdn-* flag support to gloo-proxy source by @ivankatliarchuk in #6475
[source] add --fqdn-* flag support to traefik-proxy source by @ivankatliarchuk in #6468
[source] add label filter support to contour, f5, kong, skipper, traefik sources by @ivankatliarchuk in #6538
[source/ambassador] migrate Host CRD to emissary-ingress v3alpha1 by @mloiseleur in #6482
[source] apply controller annotation filter at indexer level by @ivankatliarchuk in #6426
[source] attach RefObject to all remaining sources by @mloiseleur in #6492
[source/fake] extend fake source to emit all supported record types by @ivankatliarchuk in #6308
[source] migrate contour, f5, kong, traefik sources to indexer-based filtering by @ivankatliarchuk in #6542
[source] migrate ingress and node sources to Indexers pattern by @ivankatliarchuk in #6445
[source] set transformer on all informers by @vflaux in #6451
[source/template] add fqdn-target-template to pod/service/node and consolidate duplicate template helpers by @ivankatliarchuk in #6497
[template] support repeatable --fqdn-template, --target-template, --fqdn-target-template flags by @ivankatliarchuk in #6429
[test/crd] support CRD integration tests by @ivankatliarchuk in #6412

:bug: Bug fixes

[alibabacloud] fix TXT record value comparison during record updates by @jiangzm in #6487
[aws] incorrect behavior for non-aliasable record types by @u-kai in #6017
[awssd] use namespace-aware parsing for dotted service names by @am-ltk in #6365
[aws] unescape wildcard alias target on read by @ulascansenturk in #6471
[cloudflare] send SRV records as structured data by @tpaulus in #6560
[coredns] return AAAA for IPv6 targets by @mloiseleur in #6489
[coredns] unexpected delete when owner is activated by @farodin91 in #6206
[coredns] write PTR records without random prefix to etcd by @dongjiang1989 in #6478
create/update event generation for webhook provider by @tommasopozzetti in #6361
[dnsimple] read back all supported record types and fix record lookup by type by @Churi12 in #6517
[dynamodb] avoid nil region option panic by @vissieza in #6417
[events] encapsulate ObjectReference fields by @ivankatliarchuk in #6423
[mapper] prevent index out of bounds in ToEndpointName with multi-dot suffix by @carterpewpew in #6433
pin smartystreets/assertions. mark gandi provider for removal by @ivankatliarchuk in #6634
preserve equals signs in endpoint label values by @immanuwell in #6443
[provider/cloudflare] trim surrounding whitespace from API token by @gecube in #6533
[provider] normalize alias=A/AAAA to alias=true after AdjustEndpoints by @u-kai in #6454
[provider/rfc2136] use independent counters for AXFR and update nameserver rotation by @pujitha24 in #6591
[service] switch Endpoints() to indexer-based filtering by @ivankatliarchuk in #6344
[source/crd] allow SRV targets with trailing dot in DNSEndpoint by @SAY-5 in #6383
[source/fake.go] make fakeSource endpoint generation deterministic by @vflaux in #6411
[source] parse gloo-proxy aggregateListener virtual hosts by @pujitha24 in #6628
[source] preserve Skipper custom token file by @PragalvaXFREZ in #6583
[source] SingletonClientGenerator once-init errors by @carterpewpew in #6398
[source] use correct key when checking for existing alias in postProcessor by @u-kai in #6388
support ownership recognition of txt records by @HartmannVolker in #6435

:memo: Documentation

add Tencent Cloud webhook provider by @QianChenglong in #6432
[ai] add instructions for agents by @mloiseleur in #6453
[aws] correct hosted zone annotation prefix by @immanuwell in #6569
[ci] validate docs build on PRs targeting master by @ivankatliarchuk in #6351
clarify release tag vs kustomize manifest lag by @VedantMadane in #6626
[crd] clarify annotation-filter behavior for DNSEndpoint by @immanuwell in #6530
[faq] explain how to migrate a hostname between sources by @mloiseleur in #6490
fix deps, build & links warning by @mloiseleur in #6350
[proposal] libdns provider adapter by @mloiseleur in #6509
[readme] remove retired go report card badge by @scholar7r in #6549
[README] restructure provider and source listings by @mloiseleur in #6499
[readme] update Unifi webhook URL by @onedr0p in #6534
[rfc2136] fix duplicated word in tutorial by @s3onghyun in #6504
[traefik] clarify explicit target requirement by @immanuwell in #6502
[tutorials/aws] document AWS SDK credential provider chain by @alekc in #6444
[tutorials/aws] fix grammatical error by @Jawwad78 in #6384
[tutorials/ovh] Add single-link credential creation by @fhoekstra in #6397
[webhook] add namecheap webhook provider by @evandeaubl in #6631
[webhook] add NAVER Cloud Platform webhook provider by @inerplat in #6575
[webhook] add Porkbun webhook provider to registry by @mattgmoser in #6409
[webhook] add reference to netbird external-dns provider by @kgrotel in #6460

:package: Docker Image

# This pull command only works when it's released
docker pull registry.k8s.io/external-dns/external-dns:v0.22.0

:package: Others

<details><summary>chore</summary>

add fuzz tests for parsing and normalization functions by @Raffo in #6525
bump dependencies for update by @Raffo in #6643
bump k8s deps to v0.36.0 and remove deprecated scheme.Builder by @ivankatliarchuk in #6407
bump to go version 1.26.6 by @Raffo in #6635
[cobra] cleanup up leftover Cobra code by @vflaux in #6448
fix grpc vuln by upgrading lib by @Raffo in #6614
fix typos across codebase by @Raffo in #6385
fix x/text vulnerability by upgrading by @Raffo in #6615
follow the OpenSSF recommendations for github permissions by @Raffo in #6378
[release] updates kustomize & docs with v0.21.0 by @mloiseleur in #6349
update CI workflows to pin pip packages and go packages by @Raffo in #6498
update maintainers by @mloiseleur in #6421
update reviewers by @mloiseleur in #6427
update security contacts by @Raffo in #6425

</details>

[docs] use latest as alias by @mloiseleur in #6352
[e2e] use rollout status for etcd instead of kubectl wait by @u-kai in #6474
[github] pin github action by @ivankatliarchuk in #6428
replace GrantBirki/json-yaml-validate action with jq by @Raffo in #6318
replace pre-commit with a SHA-pinned file-hygiene script by @Raffo in #6374

</details>

bump github.com/cloudflare/cloudflare-go from v5 to v7 by @bayazee in #6550
bump github.com/projectcontour/contour from 1.33.3 to 1.33.4 by @app/dependabot in #6395
bump git

…(truncated)

v0.21.0

Apr 6, 2026Compare GitHub

:warning: Breaking Changes

chore(digitalocean)!: remove in-tree provider by @simonoff in #6283
chore(source)!: remove cloudfoundry support by @ivankatliarchuk in #6074
feat!: generalize PTR record support from rfc2136 to all providers by @clwluvw in #6232
feat(pihole)!: deprecate v5 API support by @ivankatliarchuk in #6123
feat(service)!: ignore unschedulable nodes by @ivankatliarchuk in #6002
feat(source/gateway-api)!: migrate Gateway and HTTPRoute to v1 by @System-Arch in #6291
feat(source/istio)!: migrate gateway and virtualservice sources to networking.istio.io/v1 by @ivankatliarchuk in #6302

:rocket: Features

feat(aws): enable support for NAPTR records by @alexbakker-quandago in #6022
feat(azure): dns metadata (tags) support by @vaspoz in #5984
feat(client): add --kube-api-qps and --kube-api-burst flags for Kubernetes client rate limiting by @ivankatliarchuk in #6322
feat(cli): remove cobra cli support by @ivankatliarchuk in #6034
feat(cloudflare): support batch API for DNS record changes by @mooseracerPT in #6208
feat(coredns): rename ownerId and ownedBy to owner by @farodin91 in #6032
feat(coredns): use txt-owner-id to strictly separated external-dns instances by @farodin91 in #5921
feat(crd): Support MX record with trailing dot by @HartmannVolker in #6163
feat(endpoint): introduce record-type annotation and PTR endpoint helpers by @clwluvw in #6282
feat(endpoint): reject alias property on unsupported record types by @u-kai in #6188
feat(endpoint): validate PTR records in CheckEndpoint by @clwluvw in #6275
feat: end to end testing with coredns provider by @Raffo in #5933
feat(event): emit events for ingress,svc,pod,node,crd by @ivankatliarchuk in #6099
feat(event): standardize event messages and add resource kind lookup for events by @ivankatliarchuk in #6101
feat(fqdn): Deduplicate and sort ExecTemplate output. Add functions by @ivankatliarchuk in #6173
feat(gateway): add gateway-api listenerset support by @jukie in #6254
feat(informers): reduce informer cache memory footprint via object transformers by @ivankatliarchuk in #6240
feat(metrics): added skipped_records_owner_mismatch_per_sync to track ownership conflicts by @ivankatliarchuk in #6121
feat(pdns): add --[no-]prefer-alias flag and alias annotation support by @ngnix in #6129
feat(pdns): support GetDomainFilter interface by @clwluvw in #6234
feat(pihole)!: deprecate v5 API support by @ivankatliarchuk in #6123
feat(registry/txt): enable support for SRV and NAPTR by @alexbakker-quandago in #6023
feat(service)!: ignore unschedulable nodes by @ivankatliarchuk in #6002
feat(source): add support for ingress backed GlooEdge Gateway by @cucxabong in #5909
feat(source): add unstructured source by @ivankatliarchuk in #6172
feat(source): gateway api hostname source annotation by @bogdankrasko in #5959
feat(source/gateway-api)!: migrate Gateway and HTTPRoute to v1 by @System-Arch in #6291
feat(source/istio)!: migrate gateway and virtualservice sources to networking.istio.io/v1 by @ivankatliarchuk in #6302
feat(txt): add PTR record support to TXT registry mapper and PowerDNS trailing-dot handling by @clwluvw in #6281
feat(webhook): instrument HTTP client with request duration metrics by @ivankatliarchuk in #6307

:bug: Bug fixes

fix(annotations): initialize annotation keys at declaration time by @ivankatliarchuk in #6159
fix(api): rollback changes for omitempty by @ivankatliarchuk in #6086
fix(aws): use API validation for routing policies by @u-kai in #6082
fix(chart): ptsc indentation by @andylim0221 in #6054
fix(charts): add schema for provider.webhook.serviceMonitor by @chrisbsmith in #5932
fix(charts): Skip cluster-scope RBAC on namespaced by @TobyTheHutt in #5843
fix(ci): failed to download the coveralls binary from GitHub releases by @ivankatliarchuk in #6228
fix(cloudflare): dns records pagination by @rkferreira in #5986
fix(crd): allow trailing dot in CNAME targets by @ivankatliarchuk in #6218
fix(domain-exclusion): domain exclusion filter fix by @ivankatliarchuk in #6050
fix: e2e test with kind by @Raffo in #6162
fix(endpoint): correct function name in comment by @u-kai in #6122
fix(endpoint): ensure trailing dot to target as required by RFC 2782 by @frittentheke in #5534
fix(events): re-enqueue failed events in controller work queue by @lexfrei in #6285
fix(fake): Fake clientset hangs for 10s per informer with client-go 0.35+ by @ivankatliarchuk in #6235
fix(flags): restore --min-ttl option by @vflaux in #6014
fix(fqdn): remove invalid output by @ivankatliarchuk in #6046
fix(fqdn): support kind and api version by @ivankatliarchuk in #6097
fix(lint): remove govet exclusion from tests by @vflaux in #6315
fix(lint): single file was not modernized by @ivankatliarchuk in #6059
fix(metrics): add CNAME to known record types by @marie-j in #6115
fix(pdns): ensure trailing dot for NS records by @blsho in #5992
fix(rfc2136): wrap DNS resolution errors with SoftError to prevent crashes by @e9169 in #6227
fix(scripts): helm plugins install disable verify by @vflaux in #6057
fix(service): classify nodes by best pod state in externalTrafficPolicy=Local by @ivankatliarchuk in #6271
fix(source): filter provider-specific properties to configured provider by @ivankatliarchuk in #6220
fix(tlsutils): fix nil error wrapping and wrong env var in TLS config by @ivankatliarchuk in #6198
fix(webhook): connection pool leaks, stuck goroutines on server hang, and retry correctness by @ivankatliarchuk in #6279
fix(webhook): increase test client timeouts to prevent flaky tests by @ivankatliarchuk in #6310
fix(zonefinder): transform zone name to unicode as well by @rbeuque74 in #5980

:memo: Documentation

fix(docs): Fixing typos in docs and comments by @thetillhoff in #5995
fix(docs): flags by @ivankatliarchuk in #6288
docs: add anexia docs page by @davidkroell in #6252
docs: add BIND9 on Kubernetes with Kind tutorial for rfc2136 provider by @clwluvw in #6295
docs: add bug report guide and improve issue template by @ivankatliarchuk in #6272
docs: added DeepWiki by @ivankatliarchuk in #6215
docs: add external-dns-pscloud-webhook to New providers list by @supervillain3000 in #6214
docs: add infomaniak provider reference by @M0NsTeRRR in #6258
docs: add instructions for local testing by @mloiseleur in #5887
docs: add operational best practices guide by @ivankatliarchuk in #6287
docs: add UniFi webhook provider to README by @lexfrei in #5967
docs(aws): tutorial with kind and localstack by @ivankatliarchuk in #6048
docs: Consistency review on namespaced configs in chart readme by @josemaia in #6146
docs(contributor): GetDomainFilter contract and ZoneCache blueprint for provider contributors by @ivankatliarchuk in #6249
docs: correct pod internal-hostname behavior in hostNetwork mode by @cxmcc in #6256
docs: fix nested list indentation for web rendering by @ROunofF in #6092
docs: fix typo in README by @hritz220 in #6095
docs(fqdn-template): clarify fields and add examples by @ivankatliarchuk in #6098
docs(fqdn): use correct arguments order in FQDN Templating custom functions by @zcahana in #6144
docs(metrics): add Labels column to metrics documentation table by @ivankatliarchuk in #6306
docs(ownerid): provide more details on migration by @ivankatliarchuk in #5999
docs(proposal): Gateway API annotation placement clarity proposal by @lexfrei in #5919
docs(readme): replace incorrect breaking change version v0.20.0 -> v0.19.0 by @mangkoran in #6100
docs(regexfilter): pitfalls in domain-filter zone partitioning by @ivankatliarchuk in #6255
docs: remove IBM Cloud DNS from README by @prb112 in #6007
docs: remove link to external-dns-routeros-provider by @benfiola in #5996
docs(rfc2136): hard learned lesson about AXFR by @avanier in #6083
docs(source): autogenerate docs for events by @ivankatliarchuk in #6119
docs(source): autogenerate docs for sources with go-doc like style by @ivankatliarchuk in #6075
docs(sources): surface provider-specific annotations support in documentation by @ivankatliarchuk in #6231

:package: Others

benchmark(endpoint): endpoint benchmarks by @ivankatliarchuk in #6156
chore: add Simply webhook provider to README by @uozalp in #5979
chore(aws): document and test behavior for ALB and NLB by @ivankatliarchuk in #6063
chore(chart): release for v0.20.0 by @vflaux in #6005
chore: cloudbild instance type bump by @ivankatliarchuk in #6340
chore(cloudflare): improve tests by @vflaux in #6150
chore(cloudflare): migrate customhostname to v5 by @AndrewCharlesHay in #5891
chore(cloudflare): move custom hostnames logic to dedicated files by @vflaux in #6114
chore(deps): bump github.com/aws/smithy-go from 1.23.2 to 1.24.0 in the dev-dependencies group by @app/dependabot in #5987
chore(deps): bump github.com/cloudflare/cloudflare-go from v5 to v6 by @vflaux in #6324
chore(deps): bump github.com/digitalocean/godo from 1.168.0 to 1.169.0 in the dev-dependencies group by @app/dependabot in #5956
chore(deps): bump github.com/goccy/go-yaml from 1.18.0 to 1.19.0 in the dev-dependencies group by @app/dependabot in #5985
chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0 by @app/dependabot in #5969
chore(deps): bump go-linter version by @ivankatliarchuk in #6036
chore(deps): bump google.golang.org/grpc from 1.79.2 to 1.79.3 by @app/dependabot in #6296
chore(deps): bump mkdocs by @ivankatliarchuk in #6058
chore(deps): bump mkdocs-git-revision-date-localized-plugin from 1.5.0 to 1.5.1 in /docs/scripts in the mkdocs-deps group by @app/dependabot in #6161
chore(deps): bump mkdocs-material from 9.7.1 to 9.7.3 in /docs/scripts in the mkdocs-deps group by @app/dependabot in #6237
chore(deps): bump pre-commit a

…(truncated)

v0.20.0

Nov 14, 2025Compare GitHub

General information

:warning: --min-ttl was unintentionally removed in https://github.com/kubernetes-sigs/external-dns/pull/5836 It will be restored in the next version (https://github.com/kubernetes-sigs/external-dns/pull/6014)

:rocket: Features

feat: add new flags to allow migration of OwnerID by @troll-os in #4823
feat(annotations): add custom annotation prefix support for split horizon DNS by @lexfrei in #5889
feat(aws): add ap-southeast-6 region by @rhysmdnz in #5812
feat(chart): Release for v0.19.0 by @stevehipwell in #5819
feat(cli): add Cobra binder and backend switch by @TobyTheHutt in #5820
feat(cli): migrate kingpin to cobra - dual parity by @TobyTheHutt in #5836
feat(coredns): add annotations for groups by @farodin91 in #5842
feat(coredns): pass context to etcd client by @farodin91 in #5915
feat(provider/cloudflare): add support for tags by @nkhl99 in #5862
feat(source): add min-ttl support by @ivankatliarchuk in #5641
feat(source/f5-virtual-server): add host aliases support for Virtual … by @shkarface in #5745

:bug: Bug fixes

fix(cloudflare): infinite reconciliation loop with cloudflare-record-comment flag by @vflaux in #5828
fix: cloudflare softError failedZones by @nissessenap in #5899
fix(controller): panic in OCI provider build by @vflaux in #5877
fix(coredns): debug message on labels update by @bachorp in #5789
fix(deps): bump openshift with gateway-api by @ivankatliarchuk in #5942
fix(endpoint): debug message when owner label is missing by @bachorp in #5788
fix(endpoint): deduplicate targets by @ivankatliarchuk in #5805
fix(endpoint/source) Allow '.' in TXT Records by @onelapahead in #5844
fix(gen/metrics): deduplicate generated in metrics.md by @vflaux in #5837
fix(service): rollback nodeinformer for addevent handler by @ivankatliarchuk in #5941
fix(txt-register): reset existingTXTs even when ApplyChanges is skipped to avoid stale TXT records by @u-kai in #5897

:memo: Documentation

docs(advanced): configuration precedence by @ivankatliarchuk in #5871
docs(aws): add missing supported DNS record types in Route53 ABAC by @TobyTheHutt in #5839
docs(aws): scoping the IAM policy to explicitely defined Route53 zones by @crtr109 in #5663
docs(ci): improve release note template by @mloiseleur in #5791
docs: clarify hostname annotation behavior by @PseudoResonance in #5912
docs(contributing): add reference to developer documentation by @lexfrei in #5923
docs(core-dns): update tutorial by @ivankatliarchuk in #5926
docs: fix mkdocs build by @mloiseleur in #5795
docs(gateway-api): clarify annotation placement for sources by @lexfrei in #5918
docs(myra): add info about protection option and docker image by @armaaar in #5879
docs(release): update release docs by @ivankatliarchuk in #5893
docs(tutorials): import existing DNS records into ExternalDNS by @naavveenn in #5811
docs(txt-registry): improve formatting and examples for apex record by @u-kai in #5863
docs(webhook): add volcengine provider to readme by @firemiles in #5866

:package: Others

Build(tool) remove vacuum by @szuecs in #5955
chore(ci): fix releaser script by @mloiseleur in #5953
chore(ci): speed-up & coveralls by @mloiseleur in #5870
chore(cloudflare): migrate DeleteCustomHostname() to new lib by @vflaux in #5880
chore(cloudflare): migrate DeleteDNSRecord() to new lib by @vflaux in #5780
chore(cloudflare): migrate ListRecords() to new lib by @vflaux in #5778
chore(cloudflare): migrate UpdateDNSRecord() to new lib by @vflaux in #5781
chore(controller-gen): move tools under go tools by @ivankatliarchuk in #5878
chore(deps): bump renovatebot/github-action from 43.0.10 to 43.0.11 in the dev-dependencies group by @app/dependabot in #5823
chore(deps): bump renovatebot/github-action from 43.0.11 to 43.0.12 in the dev-dependencies group by @app/dependabot in #5840
chore(deps): bump renovatebot/github-action from 43.0.12 to 43.0.13 in the dev-dependencies group by @app/dependabot in #5856
chore(deps): bump renovatebot/github-action from 43.0.13 to 43.0.14 in the dev-dependencies group by @app/dependabot in #5874
chore(deps): bump renovatebot/github-action from 43.0.14 to 43.0.15 in the dev-dependencies group by @app/dependabot in #5890
chore(deps): bump renovatebot/github-action from 43.0.9 to 43.0.10 in the dev-dependencies group by @app/dependabot in #5797
chore(deps): bump the dev-dependencies group across 1 directory with 15 updates by @app/dependabot in #5952
chore(deps): bump the dev-dependencies group across 1 directory with 36 updates by @app/dependabot in #5943
chore(deps): bump the dev-dependencies group across 1 directory with 5 updates by @app/dependabot in #5940
chore(deps): bump the dev-dependencies group across 1 directory with 9 updates by @app/dependabot in #5949
chore(deps): bump the dev-dependencies group with 2 updates by @app/dependabot in #5895
chore(deps): bump the dev-dependencies group with 2 updates by @app/dependabot in #5946
chore(deps): bump the dev-dependencies group with 3 updates by @app/dependabot in #5806
chore(lint): configure goconst linter by @lexfrei in #5929
chore(owners): update reviewers by @mloiseleur in #5925
chore(pihole): reduce cyclometic complexity of TestListRecords by @AndrewCharlesHay in #5802
chore(release): updates kustomize & docs with v0.19.0 by @mloiseleur in #5792
chore: upgrade ExternalDNS to go v1.25 and golangci-lint v2.5 by @mloiseleur in #5869
ci(linter): add gochecknoinits by @ivankatliarchuk in #5911
ci(linter): add go-critic by @PascalBourdier in #5875
doc(tutorials/rfc2136): fix RBAC by @vflaux in #5827
refactor(annotations): modernize ProviderSpecificAnnotation by @ivankatliarchuk in #5813
refactor(pihole): reduce cyclomatic complexity of TestProvider by @AndrewCharlesHay in #5865
refactor(pihole): reduce cyclomatic complexity of TestProviderV6 by @AndrewCharlesHay in #5876
refactor(service): reduce cyclomatic complexity of extractHeadlessEndpoints by @AndrewCharlesHay in #5822
refactor(source/nat64): optional source & early prefixes parsing by @vflaux in #5810
refactor(source/wrappers): move wrappers logic away from execute file by @ivankatliarchuk in #5888
test(cloudflare): clear environment variables before setting test values by @u-kai in #5851
test(cloudflare): improve coverage of zoneService by @vflaux in #5800
test(cloudflare): mock provider for cf change tests by @vflaux in #5852
test(cloudflare): modernize zoneDomainFilter test by @vflaux in #5853
test(controller): improve code coverage by @TobyTheHutt in #5816
test(source): fqdn for source/service/nodeport/srv records by @ivankatliarchuk in #5554
test(source/service): add serviceTypeFilter edge case by @ivankatliarchuk in #5872
test(source/wrappers): fix race condition by @vflaux in #5841
test: update goversion label to 1.25 in metrics test by @AndrewCharlesHay in #5886
update test certs used for pdns by @Raffo in #5902

:package: Docker Image

docker pull registry.k8s.io/external-dns/external-dns:v0.20.0

v0.19.0

Sep 2, 2025Compare GitHub

General information

:information_source: CLI flags allows to set behavior of previous version on the two breaking changes included in this release, if needed.
:information_source: Thanks to @valerian-roche, this version can reduce the average memory usage by ~10 times, see #5596

:warning: Breaking Changes

feat(nodes)!: expose external ipv6 by default by @mloiseleur in #5575
feat(traefik)!: disable legacy listeners on traefik.containo.us API Group by @mloiseleur in #5565

:rocket: Features

feat(aws): add support for ap-east-2 by @chemi0213 in #5638
feat(aws): add support for geoproximity routing by @prasadkatti in #5347
feat(azure): update Azure provider configuration and documentation by @antchand in #5648
feat(chart): add option to configure annotationFilter via dedicated helm value by @dshatokhin in #5737
feat(events): raise k8s events with fake provider by @ivankatliarchuk in #5659
feat(metrics): publish build_info metric by @ivankatliarchuk in #5643
feat(nodes)!: expose external ipv6 by default by @mloiseleur in #5575
feat(source/istio): support version 1.25+ by @ivankatliarchuk in #5611
feat(source/pods): support for annotation and label filter by @ivankatliarchuk in #5583
feat(source): support --event flags with sources pod and node by @ivankatliarchuk in #5642
feat(source): use transformers in pod informers to reduce memory footprint by @valerian-roche in #5596
feat(traefik)!: disable legacy listeners on traefik.containo.us API Group by @mloiseleur in #5565

:bug: Bug fixes

fix(api): rollback oas and update linter by @ivankatliarchuk in #5723
fix(aws): support aws_ca_bundle by @mwmix in #5665
fix(chart): Change .extraContainers type to array by @svengreb in #5564
fix(cloudflare): display of action in logs by @vflaux in #5550
fix(cloudflare): set comments properly by @7onn in #5582
fix(cloudflare): unnecessary record updates by @vflaux in #5770
fix(controller): panic in events.Controller.Add() by @vflaux in #5766
fix(docs): Fixing some errors in the dev-guide example. by @mwmix in #5662
fix(endpoint): domains handling with idna by @ivankatliarchuk in #5685
fix(helm): resolve RBAC permissions for namespaced gateway sources by @u-kai in #5578
fix(helm): Update helm value schema to allow create-only policy type by @coltonhughes in #5627
fix(http): concurrent map read/write by @ivankatliarchuk in #5753
fix(instrumented_http): migrate to own http instrumenter by @ivankatliarchuk in #5650
fix(metrics): make prometheus labels more type safe by @mwmix in #5717
fix(oas): add required properties to api components by @evilhamsterman in #5696
fix(pihole): create record for all targets by @vkolobara in #5584
fix(provider/aws): null pointer when records mailformed by @ivankatliarchuk in #5639
fix(provider/aws-sd): fix namespace type filtering by @ivankatliarchuk in #5682
fix(provider): IDNA awareness in the zone finder by @hanapedia in #5705
fix(rbac): conditional endpointslices perms by @vflaux in #5746
fix: reduce warning by using idna profile by @szuecs in #5587
fix(rfc2136): Use correct index for accessing UpdateOld if there are multiple chunks by @schwajo in #5542
fix(source): respect --expose-internal-ipv6 flag on NodePort services by @jonasbadstuebner in #5652
fix(source/service): disable node informer when not required by @ivankatliarchuk in #5613
fix(source/service): disable pod and endpointSlices informers when they are not needed by @ivankatliarchuk in #5646
fix(source/service): make sure only unique targets available for futher processing by @ivankatliarchuk in #5614
fix(txt-registry): skip creation of already-existing TXT records (#4914) by @u-kai in #5459
fix: zonefinder used wrong quotation style by @szuecs in #5588

:memo: Documentation

docs: add information on external webhook usage by @Raffo in #5606
docs: add new webhook provider SAKURA Cloud into README by @ippanpeople in #5784
docs(aws): add helm repo command to the tutorial by @raghu-manne in #5618
docs: fix typo in compatibility table by @vflaux in #5769
docs(istio): document ingress annotation by @ivankatliarchuk in #5756
docs(providers): add Myra Security DNS to the list by @armaaar in #5671
docs(readme): update k8s compatiblity table by @vflaux in #5747
docs: remove substitution in AES keygen examples by @super-octo-spoon in #5686
docs(source/service): headless records and root/base domain by @ivankatliarchuk in #5624

:package: Others

chore(ci): improve releaser script by @mloiseleur in #5571
chore(ci): update labels automation by @mloiseleur in #5580
chore(cloudflare): migrate CreateDNSRecord() to new lib by @vflaux in #5779
chore(cloudflare): migrate DNSRecord to new lib struct by @vflaux in #5762
chore(cloudflare): rename zoneService fields by @vflaux in #5761
chore(cloudflare): upgrade library to v5 by @vflaux in #5734
chore(cloudflare): use lib v4 for regional services by @vflaux in #5609
chore(codebase): code reuse by @ivankatliarchuk in #5607
chore(codebase): enable linter nonamedreturns by @ivankatliarchuk in #5594
chore(codebase): remove pointer to an interface by @ivankatliarchuk in #5625
chore(deps): bump github.com/cloudflare/cloudflare-go/v4 from 4.5.1 to 4.6.0 in the dev-dependencies group by @app/dependabot in #5645
chore(deps): bump github.com/digitalocean/godo from 1.155.0 to 1.156.0 in the dev-dependencies group by @app/dependabot in #5623
chore(deps): bump github.com/oracle/oci-go-sdk/v65 from 65.94.0 to 65.95.0 in the dev-dependencies group by @app/dependabot in #5597
chore(deps): bump google.golang.org/api from 0.239.0 to 0.240.0 in the dev-dependencies group by @app/dependabot in #5605
chore(deps): bump renovatebot/github-action from 43.0.1 to 43.0.2 in the dev-dependencies group by @app/dependabot in #5592
chore(deps): bump renovatebot/github-action from 43.0.2 to 43.0.3 in the dev-dependencies group by @app/dependabot in #5644
chore(deps): bump renovatebot/github-action from 43.0.4 to 43.0.5 in the dev-dependencies group by @app/dependabot in #5691
chore(deps): bump the dev-dependencies group across 1 directory with 10 updates by @app/dependabot in #5760
chore(deps): bump the dev-dependencies group across 1 directory with 17 updates by @app/dependabot in #5704
chore(deps): bump the dev-dependencies group across 1 directory with 17 updates by @app/dependabot in #5726
chore(deps): bump the dev-dependencies group across 1 directory with 18 updates by @app/dependabot in #5739
chore(deps): bump the dev-dependencies group across 1 directory with 2 updates by @app/dependabot in #5667
chore(deps): bump the dev-dependencies group across 1 directory with 2 updates by @app/dependabot in #5732
chore(deps): bump the dev-dependencies group across 1 directory with 2 updates by @app/dependabot in #5759
chore(deps): bump the dev-dependencies group across 1 directory with 3 updates by @app/dependabot in #5579
chore(deps): bump the dev-dependencies group across 1 directory with 5 updates by @app/dependabot in #5690
chore(deps): bump the dev-dependencies group across 1 directory with 8 updates by @app/dependabot in #5637
chore(deps): bump the dev-dependencies group across 1 directory with 8 updates by @app/dependabot in #5658
chore(deps): bump the dev-dependencies group with 10 updates by @app/dependabot in #5668
chore(deps): bump the dev-dependencies group with 2 updates by @app/dependabot in #5610
chore(deps): bump the dev-dependencies group with 3 updates by @app/dependabot in #5628
chore(deps): bump the dev-dependencies group with 4 updates by @app/dependabot in #5593
chore(deps): bump the dev-dependencies group with 4 updates by @app/dependabot in #5673
chore(deps): bump the dev-dependencies group with 9 updates by @app/dependabot in #5763
chore(deps): update golangci-lint version to v2.2.2 by @dongjiang1989 in #5670
chore(endpoint): fix typo by @bachorp in #5787
chore(github-actions): test execution with low resources by @ivankatliarchuk in #5729
chore(github): enchance issue-template for bug-report by @ivankatliarchuk in #5692
chore(helm): add rbac unit-tests for istio sources by @ivankatliarchuk in #5752
chore(metrics): refactor metrics to use common registry by @mwmix in #5677
chore(plan): added tests for cases with asterisks by @ivankatliarchuk in #5640
chore(provider/aws): reduce if-nesting for dryRun condition by @ivankatliarchuk in #5688
chore: release chart for v0.18.0 by @elafarge in #5633
chore(release): updates kustomize & docs with v0.18.0 by @mloiseleur in #5573
chore(source/istio): replace kube API calls with caching and ingress informers by @ivankatliarchuk in #5743
chore(source/net-filter): improve flow logic and add more tests by @ivankatliarchuk in #5629
chore(source): reorganise sources and wrappers by @ivankatliarchuk in #5598
chore(source): use types instead of strings by @ivankatliarchuk in #5699
chore(store*): add reduce complexity and improve code coverage by @AndrewCharlesHay in #5568
refactor(annotations): use common prefix to simplify filtering in informer transformers by @valerian-roche in #5621
refactor(cloudflare): use lib v4 for zone services by @AndrewCharlesHay in #5654
refactor(provider/cloudflare): use local regionalHostname struct by @vflaux in #5615
refactor(source): document and add debug information on wrappers by @ivankatliarchuk in #5687
refactor(source/istio): add transformers by @ivankatliarchuk in #5728
refactor: use slices.Contains instead of handrolled for loop by @szuecs in #5589
test: improve coverage on http and metrics by @mwmix in #5712
test(source/istio): add missing edge cases with tests by @ivankatliarchuk in #5715
tests(source/crd): increase timeouts when it can randomly fails by @vflaux in #5785

:pa

…(truncated)

v0.18.0

Jun 26, 2025Compare GitHub

General information

:warning: This release requires a RBAC update on endpointslices. It will be included in the next Chart release, see #5493.

:warning: The exposed metrics has been significantly changed. You'll need to update your observability stack accordingly, see #5516

:warning: The CLI flag --txt-new-format-only has been removed. Now it's the only format supported, see #5172

:information_source: This release remove in-tree support for ibmcloud, tencentcloud & ultradns. Users needing those providers can use a previous version of external-dns or create a webhook-based provider.

:information_source: The change on default-targets behavior provide a mitigation strategy, if you need it, see #5316

:warning: Breaking Changes

chore!: remove unmaintained providers by @mloiseleur in #5463
feat(controller)!: publish metrics for all supported endpoint types by @ivankatliarchuk in #5516
feat(source)!: introduce optional force-default-targets by @alen-z in #5316
feat(source): use EndpointSlices instead of Endpoints for Service by @vflaux in #5493
feat(txt-registry): deprecate legacy txt-format by @ivankatliarchuk in #5172

:rocket: Features

feat(chart): add missing changelog for #5493 by @vflaux in #5541
feat(cloudflare): add support for MX records by @arthlr in #5283
feat(cloudflare): change defaultCA from google to empty string by @henryjarend in #5453
feat(cloudflare): improve cloudflare regional hostnames implementation by @vflaux in #5309
feat(cloudflare): Suppport DNS record comments by @7onn in #5411
feat(controller)!: publish metrics for all supported endpoint types by @ivankatliarchuk in #5516
feat(endpoint): IDNA aware in Plan and DomainFilter by @kimsondrup in #5049
feat(fqdn): improve ExecTemplate and add more functions by @ivankatliarchuk in #5406
feat(metrics): consecutiveSoftErrors by @AndrewCharlesHay in #5502
feat(source): add resouce labels for nodes by @ivankatliarchuk in #5509
feat(source)!: introduce optional force-default-targets by @alen-z in #5316
feat(source/node): fqdn support combineFQDNAnnotation by @ivankatliarchuk in #5526
feat(source/pod): add support for fqdn templating by @ivankatliarchuk in #5512
feat(source): support ttl annotation on pod by @ivankatliarchuk in #5527
feat(source): use EndpointSlices instead of Endpoints for Service by @vflaux in #5493

:bug: Bug fixes

fix(azure): enhance retry logic using azure SDK by @Reddyshruti26 in #5361
fix(chart): release chart process by @stevehipwell in #5538
fix(chart): release chart workflow by @Bartosz-lab in #5533
fix(chart): update schema with latest plugin release by @mloiseleur in #5510
fix(cloudflare): improve handling of rate limiting errors by @Hackatosh in #5524
fix: createRecord for alibabacloud provider by @zengyuxing007 in #5432
fix(docs): resolve broken links, add source description by @linoleparquet in #5413
fix(f5): validate virtualservers and transportservers based on IP only by @mikejoh in #5532
fix: ovh: correct handling of records deletion by @rbeuque74 in #5450
fix(provider): aws-sd provider null pointer by @ivankatliarchuk in #5404
fix(provider/coredns): errjson linter by @ivankatliarchuk in #5506
fix(rfc2136): collect existing records from all configured zones by @joshlreese in #5426
fix(rfc2136): credential and realm issue when using active directory by @Jeremy-Boyle in #5385
fix(source): expose internal ipv6 flag on headless service by @kevinvalk in #5399
fix(source/node): template expansion by @ivankatliarchuk in #5498
fix(source/pod): discrepancy between the documentation and the actual behavior by @foyerunix in #5409

:memo: Documentation

docs: add alibaba cloud provider reference by @zengyuxing007 in #5431
docs: add deSEC webhook by @michelangelomo in #5460
docs: add missing import by @lucasfcnunes in #5500
docs(cloudflare): add list of accepted values for regional host by @AndrewCharlesHay in #5495
docs(contributing): detail how to test a PR by @mloiseleur in #5443
docs(github): update pr template by @mloiseleur in #5445
docs(traefik): public and private routing by @ivankatliarchuk in #5559
docs: unbound webhook by @guillomep in #5434

:package: Others

add IONOS Cloud webhook reference by @smilutinovic-ionos in #5475
chore(ci): fix testify linter by @mloiseleur in #5461
chore(ci): rework labels in OWNERS by @mloiseleur in #5481
chore(cloudflare): move regional services logic to dedicated file by @vflaux in #5329
chore(cloudflare): remove unused funcs by @vflaux in #5553
chore(code): add pre-commit github action by @ivankatliarchuk in #5414
chore(codebase): add cyclop max by @AndrewCharlesHay in #5427
chore(codebase): add linters for json/yaml tags by @ivankatliarchuk in #5418
chore(codebase): add nilnil return check by @ivankatliarchuk in #5415
chore(codebase): enable copyloopvar by @ivankatliarchuk in #5433
chore(codebase): enable dupword linter by @ivankatliarchuk in #5437
chore(codebase): enable errorlint by @ivankatliarchuk in #5439
chore(codebase): enable linter recvcheck by @ivankatliarchuk in #5522
chore(codebase): enable testifylint by @ivankatliarchuk in #5441
chore(codebase): enable usestdlibvars for Go constants by @ivankatliarchuk in #5438
chore(code-quality): added linter errchkjson by @ivankatliarchuk in #5448
chore(code-quality): reduce cyclomatic complexity of podSource.Endpoints() by @vflaux in #5470
chore(code-quality): reduce cyclomatic complexity of validation.ValidateConfig by @vflaux in #5451
chore(crd): move code to apis/v1alpha1 by @mloiseleur in #5446
chore(deps): bump json-yaml-validate to v3.3.1 by @mloiseleur in #5563
chore(deps): bump renovatebot/github-action from 42.0.5 to 42.0.6 in the dev-dependencies group by @app/dependabot in #5530
chore(deps): bump renovatebot/github-action from 42.0.6 to 43.0.0 in the dev-dependencies group by @app/dependabot in #5556
chore(deps): bump renovatebot/github-action from 43.0.0 to 43.0.1 in the dev-dependencies group by @app/dependabot in #5557
chore(deps): bump the dev-dependencies group across 1 directory with 11 updates by @app/dependabot in #5484
chore(deps): bump the dev-dependencies group across 1 directory with 13 updates by @app/dependabot in #5539
chore(deps): bump the dev-dependencies group across 1 directory with 14 updates by @app/dependabot in #5408
chore(deps): bump the dev-dependencies group across 1 directory with 14 updates by @app/dependabot in #5511
chore(deps): bump the dev-dependencies group across 1 directory with 2 updates by @app/dependabot in #5531
chore(deps): bump the dev-dependencies group across 1 directory with 2 updates by @app/dependabot in #5566
chore(deps): bump the dev-dependencies group across 1 directory with 3 updates by @app/dependabot in #5480
chore(deps): bump the dev-dependencies group across 1 directory with 3 updates by @app/dependabot in #5520
chore(deps): bump the dev-dependencies group with 10 updates by @app/dependabot in #5519
chore(deps): bump the dev-dependencies group with 2 updates by @app/dependabot in #5555
chore(deps): bump the dev-dependencies group with 3 updates by @app/dependabot in #5544
chore(docs): add mkdocs-macros plugin by @ivankatliarchuk in #5412
chore(docs): document the default behavior of --[no-]combine-fqdn-annotation by @shapirus in #5403
chore(docs): fix documentation references by @ivankatliarchuk in #5560
chore(docs): update aws role requirements with conditions by @ivankatliarchuk in #5353
chore(domainfilter): use pointer receivers for DomainFilter by @u-kai in #5546
chore(provider/coredns): improve code coverage and reduce complexity by @ivankatliarchuk in #5456
chore(release): chart for v0.17.0 by @stevehipwell in #5479
chore(release): updates kustomize & docs with v0.17.0 by @mloiseleur in #5396
chore(source): code coverage and refactoring of traefik by @ivankatliarchuk in #5380
chore(source/crd): improve test coverage, fix deprecations by @ivankatliarchuk in #5489
chore(source/crd): optimize endpoint labels without looping over by @ivankatliarchuk in #5492
chore(source/ingress): add fqdn specific tests for ingress source by @ivankatliarchuk in #5507
chore(source): move cache informer to dedicated folder by @ivankatliarchuk in #5466
chore(source): reduce cyclomatic complexity of extractNodePortTargets by @linoleparquet in #5444
chore(source/service): add resource label without looping over by @ivankatliarchuk in #5528
chore(source/service): restructure code to make service type filters testable by @ivankatliarchuk in #5485
chore: update maintainers by @mloiseleur in #5491
perf(source): benchmarks on EndpointTargetsFromServices by @ivankatliarchuk in #5536
refactor(provider): replace switch with if for record type filtering by @u-kai in #5548
revert: fix on gateway-api that ensure to use only latest generation with HTTPRoutes by @mloiseleur in #5490
test(awssd): fix a flaky test by @vflaux in #5552
test(controller): increase timeout and refactor toggle registry test by @u-kai in #5518
test(controller): reduce complexity and improve code coverage by @ivankatliarchuk in #5523
test(endpoint): improve coverage from 76% to 95.9% by @upsaurav12 in #5421
test(metrics): replace random value with a static value by @u-kai in #5462
test(provider/civo): improved test coverage by @upsaurav12 in #5455
test(provider/gandi): bumped to 100% coverage by @upsaurav12 in #5454
test(source): add fqdn specific tests on service by @ivankatliarchuk in #5529
test(source): fix flakyness on pod_test.go by @mloiseleur in #5514
test(source): remove flaky log assertions from pod tests by @u-kai in #5517
test(testutils/endpoint): improved test coverage for testutils/endpoint by @upsaurav12 in #5425
test(tlscon

…(truncated)

v0.17.0

May 14, 2025GitHub

Global information

:information_source: On Pi Hole, support for v6 has been added. Pi Hole v5 support is deprecated and will be removed in a future version

:information_source: On OVH, the provider has been heavily rewritten. New ACLs are need. See documentation and PR #5143 for details.

:information_source: On IPv6, the proposal 002 has been implemented, thanks to @hjoshi123

:warning: In the next release, the default of this new expose-internal-ipv6 flag will be set to false

:warning: There is a severe known issue with Active Directory (#5240) since v0.16.0. PR to fix it (#5385) is in review

:information_source: The legacy txt-format will be removed in the next minor version (#5172)

:warning: There is currently no migration script to clean old style txt records. If you need it, if you think you can do it, PRs are welcome.

:information_source: A new Nomad source may be added to external-dns (#5284)

This PR can be merged only after a review and test from real Nomad users

:rocket: Features

feat: additional template functions by @matkam in #3949
feat(banner): standardize user agent and output by @ivankatliarchuk in #5154
feat(chart): Update image to v0.16.1 by @stevehipwell in #5201
feat(cloudflare): multiple custom hostnames support by @mrozentsvayg in #5239
feat(helm): allow extraArgs to also be a map enabling overrides of individual values by @frittentheke in #5293
feat: IDNA awareness in the zone finder by @lexisother in #5147
feat(ovh): major rewriting of the provider by @rbeuque74 in #5143
feat(pihole): add optional support for v6 by @tJouve in #5226
feat(pihole): add support for IPv6 Dual format by @tJouve in #5253
feat(source): optional exclusion of unschedulable nodes by @Hayajiro in #5045
feat(source): optional expose of nodes internal ipv6 by @hjoshi123 in #5192

:bug: Bug fixes

fix(aws): typo on route53 IAM by @tico24 in #5197
fix(chart): add missing types for empty values by @t3mi in #5207
fix(cloudflare): custom hostnames edge-cases causing duplicates by @mrozentsvayg in #5183
fix(cloudflare): regional hostnames by @vflaux in #5175
fix(Gateway API): ensure generation match by @davidwin93 in #5241
fix(gateway-api): ensure to use only latest generation with HTTPRoutes by @kashalls in #5349
fix(helm): added missing schema values by @ivankatliarchuk in #5228
fix(helm): update helm schema by @semnell in #5297
fix(log testing): re-use logger library testing functionality by @ivankatliarchuk in #5368
fix(node): logger test fixed by @ivankatliarchuk in #5232
fix(ovh): handling capitalized DNS records + prevent panic by @rbeuque74 in #5390
fix(webhook): api json object plan.Changes case by @ivankatliarchuk in #5355
fix(zonefinder): handle underscores in dns records by @arthlr in #5281

:memo: Documentation

docs(contributing): add conventional commits by @mloiseleur in #5333
docs(proposal): externaldns api graduation to beta by @ivankatliarchuk in #5079
docs(rfc2136): fix env variable in the guideline by @riupie in #5352
docs(tutorials): add IONOS Cloud setup tutorial for ExternalDNS by @smilutinovic-ionos in #5364
docs(typo): grcp → grpc by @octo in #5231
docs: update link to Anexia webhook provider by @mloiseleur in #5244
docs: update rfc2136 by @BasJ93 in #5325

:package: Others

Add Yandex Cloud Webhook by @ismailbaskin in #5190
chore: add se for nlb, alb in thailand region by @xshot9011 in #5200
chore: fix typo on txtOwnerId comment/description by @lanandra in #5351
chore(ci): fix random data race failure on source/node test by @mloiseleur in #5268
chore(ci): improve release script by @mloiseleur in #5394
chore(ci): update linter to v2.0.2 by @mloiseleur in #5246
chore(code-cleanup): move logic away from main.go add tests by @ivankatliarchuk in #5222
chore(code): improve some tests + re-order sources flags CLI by @mloiseleur in #5288
chore(code-quality): added lint checks by @ivankatliarchuk in #5318
chore(code-quality): providers linter warnings fixes by @ivankatliarchuk in #5320
chore(code-quality): refactoring and linter fixes by @ivankatliarchuk in #5374
chore(code-quality): webhook increase code coverage by @ivankatliarchuk in #5337
chore(crd): use conventional paths and update controller-gen to v0.17.2 by @mloiseleur in #5287
chore(dependencies): update toools versions by @ivankatliarchuk in #5252
chore(deps): build with go 1.24.2 by @mloiseleur in #5306
chore(deps): bump renovatebot/github-action from 41.0.14 to 41.0.16 in the dev-dependencies group by @app/dependabot in #5188
chore(deps): bump renovatebot/github-action from 41.0.16 to 41.0.17 in the dev-dependencies group by @app/dependabot in #5210
chore(deps): bump the dev-dependencies group across 1 directory with 14 updates by @app/dependabot in #5346
chore(deps): bump the dev-dependencies group across 1 directory with 14 updates by @app/dependabot in #5382
chore(deps): bump the dev-dependencies group across 1 directory with 17 updates by @app/dependabot in #5238
chore(deps): bump the dev-dependencies group across 1 directory with 19 updates by @app/dependabot in #5262
chore(deps): bump the dev-dependencies group across 1 directory with 20 updates by @app/dependabot in #5211
chore(deps): bump the dev-dependencies group across 1 directory with 21 updates by @mloiseleur in #5313
chore(deps): bump the dev-dependencies group across 1 directory with 2 updates by @app/dependabot in #5247
chore(deps): bump the dev-dependencies group across 1 directory with 2 updates by @app/dependabot in #5301
chore(deps): bump the dev-dependencies group across 1 directory with 2 updates by @app/dependabot in #5323
chore(deps): code cleanup, pkg/errors is archived by @ivankatliarchuk in #5335
chore(deps): switch to goccy yaml by @Raffo in #5292
chore(deps): update linter to v2.1.x by @mloiseleur in #5366
chore(fqdn-template): fqdn templating move to specific folder and update documentation by @ivankatliarchuk in #5354
chore(github): add a release template by @ivankatliarchuk in #5324
chore(helm): add validation for prefix and suffix and capture regression by @ivankatliarchuk in #5250
chore(openstack designate)!: remove in-tree provider by @mloiseleur in #5126
chore(providers): rename custom TTL constants to defaultTTL by @ivankatliarchuk in #5312
chore: Release Helm chart v1.16.1 by @stevehipwell in #5270
chore(release): updates kustomize & docs with v0.16.1 by @mloiseleur in #5184
chore(source): code cleanup by @ivankatliarchuk in #5304
chore(webhook): bump cenkalti/backoff version by @ivankatliarchuk in #5342
test: add tests for cloudflare provider by @natitomattis in #5248
test(log): execute on multiple platforms by @ivankatliarchuk in #5370
test(log): fix random race detection by @ivankatliarchuk in #5273
test(source): cover unhappy paths by @linoleparquet in #5369
test(source): fix data race on node_test by @mloiseleur in #5334
test(source/pod): improve code coverage by @ivankatliarchuk in #5378
test(tlsconfig): add unit tests by @linoleparquet in #5381
test(zone_filter): improve coverage from 66.7% to 100% by @upsaurav12 in #5388

:package: Docker Image

docker pull registry.k8s.io/external-dns/external-dns:v0.17.0

New Contributors

@ismailbaskin made their first contribution in https://github.com/kubernetes-sigs/external-dns/pull/5190
@lexisother made their first contribution in https://github.com/kubernetes-sigs/external-dns/pull/5147
@tico24 made their first contribution in https://github.com/kubernetes-sigs/external-dns/pull/5197
@t3mi made their first contribution in https://github.com/kubernetes-sigs/external-dns/pull/5207
@octo made their first contribution in https://github.com/kubernetes-sigs/external-dns/pull/5231
@xshot9011 made their first contribution in https://github.com/kubernetes-sigs/external-dns/pull/5200
@tJouve made their first contribution in https://github.com/kubernetes-sigs/external-dns/pull/5226
@Hayajiro made their first contribution in https://github.com/kubernetes-sigs/external-dns/pull/5045
@davidwin93 made their first contribution in https://github.com/kubernetes-sigs/external-dns/pull/5241
@vflaux made their first contribution in https://github.com/kubernetes-sigs/external-dns/pull/5175
@arthlr made their first contribution in https://github.com/kubernetes-sigs/external-dns/pull/5281
@semnell made their first contribution in https://github.com/kubernetes-sigs/external-dns/pull/5297
@BasJ93 made their first contribution in https://github.com/kubernetes-sigs/external-dns/pull/5325
@natitomattis made their first contribution in https://github.com/kubernetes-sigs/external-dns/pull/5248
@riupie made their first contribution in https://github.com/kubernetes-sigs/external-dns/pull/5352
@lanandra made their first contribution in https://github.com/kubernetes-sigs/external-dns/pull/5351
@smilutinovic-ionos made their first contribution in https://github.com/kubernetes-sigs/external-dns/pull/5364
@linoleparquet made their first contribution in https://github.com/kubernetes-sigs/external-dns/pull/5369
@kashalls made their first contribution in https://github.com/kubernetes-sigs/external-dns/pull/5349
@matkam made their first contribution in https://github.com/kubernetes-sigs/external-dns/pull/3949
@upsaurav12 made their first contribution in https://github.com/kubernetes-sigs/external-dns/pull/5388

Full Changelog: https://github.com/kubernetes-sigs/external-dns/compare/v0.16.1...v0.17.0

ExternalDNS

Build Status Coverage Status OpenSSF GitHub release go-doc ExternalDNS docs Ask DeepWiki

ExternalDNS synchronizes exposed Kubernetes Services and Ingresses with DNS providers.

Documentation

This README is a part of the complete documentation, available here and DeepWiki.

What It Does

Inspired by Kubernetes DNS, Kubernetes' cluster-internal DNS server, ExternalDNS makes Kubernetes resources discoverable via public DNS servers. Like KubeDNS, it retrieves a list of resources (Services, Ingresses, etc.) from the Kubernetes API to determine a desired list of DNS records. Unlike KubeDNS, however, it's not a DNS server itself, but merely configures other DNS providers accordingly—e.g. AWS Route 53 or Google Cloud DNS.

In a broader sense, ExternalDNS allows you to control DNS records dynamically via Kubernetes resources in a DNS provider-agnostic way.

The FAQ contains additional information and addresses several questions about key concepts of ExternalDNS.

To see ExternalDNS in action, have a look at this video or read this blogpost.

Running ExternalDNS

ExternalDNS allows you to keep selected zones (via --domain-filter) synchronized with Ingresses and Services of type=LoadBalancer and nodes in many DNS providers. See In-tree providers for the built-in list, and New providers for webhook-based ones.

ExternalDNS is, by default, aware of the records it is managing, therefore it can safely manage non-empty hosted zones. We strongly encourage you to set --txt-owner-id to a unique value that doesn't change for the lifetime of your cluster. You might also want to run ExternalDNS in a dry run mode (--dry-run flag) to see the changes to be submitted to your DNS Provider API.

Note that all flags can be replaced with environment variables; for instance, --dry-run could be replaced with EXTERNAL_DNS_DRY_RUN=1.

ExternalDNS runs as a controller in your cluster, and can also be run locally to test a configuration. For provider-specific setup, see the In-tree providers table (each row links its tutorial) or the webhook providers. More tutorials — ingress controllers, sources, and provider extras — are in the full documentation.

<details> <summary><b>Running Locally</b></summary>

See the contributor guide for details on compiling from source.

Setup Steps

Next, run an application and expose it via a Kubernetes Service:

kubectl run nginx --image=nginx --port=80
kubectl expose pod nginx --port=80 --target-port=80 --type=LoadBalancer

Annotate the Service with your desired external DNS name. Make sure to change example.org to your domain.

kubectl annotate service nginx "external-dns.kubernetes.io/hostname=nginx.example.org."

Optionally, you can customize the TTL value of the resulting DNS record by using the external-dns.kubernetes.io/ttl annotation:

kubectl annotate service nginx "external-dns.kubernetes.io/ttl=10"

For more details on configuring TTL, see advanced ttl.

Use the internal-hostname annotation to create DNS records with ClusterIP as the target.

kubectl annotate service nginx "external-dns.kubernetes.io/internal-hostname=nginx.internal.example.org."

If the service is not of type Loadbalancer you need the --publish-internal-services flag.

Locally run a single sync loop of ExternalDNS.

external-dns --txt-owner-id my-cluster-id --provider google --google-project example-project --source service --once --dry-run

This should output the DNS records it will modify to match the managed zone with the DNS records you desire. It also assumes you are running in the default namespace. See the FAQ for more information regarding namespaces.

Note: TXT records will have the my-cluster-id value embedded. Those are used to ensure that ExternalDNS is aware of the records it manages.

Once you're satisfied with the result, you can run ExternalDNS like you would run it in your cluster: as a control loop, and not in dry-run mode:

external-dns --txt-owner-id my-cluster-id --provider google --google-project example-project --source service

Check that ExternalDNS has created the desired DNS record for your Service and that it points to its load balancer's IP. Then try to resolve it:

dig +short nginx.example.org.
104.155.60.49

Now you can experiment and watch how ExternalDNS makes sure that your DNS records are configured as desired. Here are a couple of things you can try out:

Change the desired hostname by modifying the Service's annotation.
Recreate the Service and see that the DNS record will be updated to point to the new load balancer IP.
Add another Service to create more DNS records.
Remove Services to clean up your managed zone (record deletion requires --policy=sync; with --policy=upsert-only records are never deleted).

</details>

Note

If using a txt registry and attempting to use a CNAME the --txt-prefix must be set to avoid conflicts. Changing --txt-prefix will result in lost ownership over previously created records.

If externalIPs list is defined for a LoadBalancer service, this list will be used instead of an assigned load balancer IP to create a DNS record. It's useful when you run bare metal Kubernetes clusters behind NAT or in a similar setup, where a load balancer IP differs from a public IP (e.g. with MetalLB).

New providers

No new provider will be added to ExternalDNS in-tree.

ExternalDNS has introduced a webhook system, which can be used to add a new provider. See PR #3063 for all the discussions about it.

Some known providers using webhooks are the ones in the table below.

NOTE: The maintainers of ExternalDNS have not reviewed those providers, use them at your own risk and following the license and usage recommendations provided by the respective projects. The maintainers of ExternalDNS take no responsibility for any issue or damage from the usage of any externally developed webhook.

Provider	Repo
Abion	https://github.com/abiondevelopment/external-dns-webhook-abion
Adguard Home Provider	https://github.com/muhlba91/external-dns-provider-adguard
Akamai Edge DNS	https://github.com/PixiBixi/external-dns-akamai-webhook
Anexia	https://github.com/anexia/k8s-external-dns-webhook
Bizfly Cloud	https://github.com/bizflycloud/external-dns-bizflycloud-webhook
ClouDNS	https://github.com/rwunderer/external-dns-cloudns-webhook
deSEC	https://github.com/michelangelomo/external-dns-desec-provider
DigitalOcean	https://github.com/amoniacou/external-dns-digitalocean-webhook
Dreamhost	https://github.com/asymingt/external-dns-dreamhost-webhook
Efficient IP	https://github.com/EfficientIP-Labs/external-dns-efficientip-webhook
Gcore	https://github.com/G-Core/external-dns-gcore-webhook
GleSYS	https://github.com/glesys/external-dns-glesys
Hetzner	https://github.com/mconfalonieri/external-dns-hetzner-webhook
Huawei Cloud	https://github.com/setoru/external-dns-huaweicloud-webhook
IONOS	https://github.com/ionos-cloud/external-dns-ionos-webhook
Infoblox NIOS	https://github.com/AbsaOSS/external-dns-infoblox-webhook
Infoblox UDDI	https://github.com/wayvz-io/external-dns-uddi-webhook
Infomaniak	https://github.com/M0NsTeRRR/external-dns-webhook-infomaniak
Mikrotik	https://github.com/mirceanton/external-dns-provider-mikrotik
Myra Security	https://github.com/Myra-Security-GmbH/external-dns-myrasec-webhook
Namecheap	https://github.com/evandeaubl/external-dns-namecheap-webhook
NAVER Cloud Platform	https://github.com/NaverCloudPlatform/external-dns-navercloud-webhook
Netbird	https://codeberg.org/ccbash-oss/external-dns-netbird-webhook
Netcup	https://github.com/mrueg/external-dns-netcup-webhook
Netic	https://github.com/neticdk/external-dns-tidydns-webhook
OpenStack Designate	https://github.com/inovex/external-dns-designate-webhook
OpenWRT	https://github.com/renanqts/external-dns-openwrt-webhook
Porkbun	https://github.com/mattgmoser/external-dns-porkbun-webhook
PS Cloud Services	https://github.com/supervillain3000/external-dns-pscloud-webhook
SAKURA Cloud	https://github.com/sacloud/external-dns-sacloud-webhook
Simply	https://github.com/uozalp/external-dns-simply-webhook
STACKIT	https://github.com/stackitcloud/external-dns-stackit-webhook
Tencent Cloud	https://github.com/tkestack/external-dns-tencentcloud-webhook
Unbound	https://github.com/guillomep/external-dns-unbound-webhook
Unifi	https://github.com/home-operations/external-dns-unifi-webhook
UniFi	https://github.com/lexfrei/external-dns-unifios-webhook
Volcengine Cloud	https://github.com/volcengine/external-dns-volcengine-webhook
Vultr	https://github.com/vultr/external-dns-vultr-webhook
Yandex Cloud	https://github.com/ismailbaskin/external-dns-yandex-webhook/

In-tree providers

ExternalDNS supports the DNS providers below, implemented by the ExternalDNS contributors. Maintaining all of these in a central repository introduces lots of toil and potential risks, so external-dns has begun moving providers out of tree (see #4347). No new in-tree providers are accepted; use the webhook system instead.

Those interested can create a webhook provider based on an in-tree provider and submit a PR to reference it in the table above. Providers without a maintainer listed are in need of assistance.

Provider	Maintainers	Tutorials
Alibaba Cloud DNS		guide
AWS Cloud Map		guide
AWS Route 53		Route 53, public & private zones, filters, LocalStack, Load Balancer Controller, kube-ingress-aws
AzureDNS		Azure DNS, Private DNS
Civo	@alejandrojnm	guide
CloudFlare		guide
CoreDNS		guide, etcd backend
DNSimple		guide
Exoscale		guide
GoDaddy		guide
Google Cloud DNS		GKE default ingress, GKE with nginx
Linode DNS		guide
NS1		guide
Oracle Cloud Infrastructure DNS		guide
OVHcloud	@rbeuque74	guide
Pi-hole	@tinyzimmer	guide
PowerDNS		guide
RFC2136		guide
Scaleway DNS	@Sh4d1	guide

Sources

ExternalDNS reads Kubernetes resources from one or more sources (set via --source) and turns them into the desired DNS records. See the sources documentation for the full list and configuration details.

Source	Tutorials
Ambassador Host	guide
Connector	—
Contour HTTPProxy	guide
DNSEndpoint (CRD)	NS records, MX records, TXT records, tutorial
F5 TransportServer	guide
F5 VirtualServer	guide
Fake (testing)	guide
Gateway API Routes	guide, route sources
Gloo Proxy	guide
Istio Gateway & VirtualService	guide
Kong TCPIngress	guide
Kubernetes Ingress	guide
Kubernetes Node	guide
Kubernetes Pod	guide
Kubernetes Service	guide, ExternalName, Headless
OpenShift Route	guide
Skipper RouteGroup	guide
Traefik IngressRoute	guide
Unstructured (custom CRD)	guide

Kubernetes version compatibility

Breaking changes were introduced in external-dns in the following versions:

v0.10.0: use of networking.k8s.io/ingresses instead of extensions/ingresses (see #2281)
v0.18.0: use of discovery.k8s.io/endpointslices instead of endpoints (see #5493)
v0.19.0: don't expose internal ipv6 by default (see #5575) and disable legacy listeners on traefik.containo.us API Group (see #5565)

ExternalDNS	≤ 0.9.x	≥ 0.10.x and ≤ 0.17.x	≥ 0.18.x
Kubernetes ≤ 1.18	:white_check_mark:	:x:	:x:
Kubernetes 1.19 and 1.20	:white_check_mark:	:white_check_mark:	:x:
Kubernetes 1.21	:white_check_mark:	:white_check_mark:	:white_check_mark:
Kubernetes ≥ 1.22 and ≤ 1.32	:x:	:white_check_mark:	:white_check_mark:
Kubernetes ≥ 1.33	:x:	:x:	:white_check_mark:

Contributing

Are you interested in contributing to external-dns? We, the maintainers and community, would love your suggestions, contributions, and help! Also, the maintainers can be contacted at any time to learn more about how to get involved.

We also encourage ALL active community participants to act as if they are maintainers, even if you don't have "official" write permissions. This is a community effort, we are here to serve the Kubernetes community. If you have an active interest and you want to get involved, you have real power! Don't assume that the only people who can get things done around here are the "maintainers". We also would love to add more "official" maintainers, so show us what you can do!

The external-dns project is currently in need of maintainers for specific DNS providers. Ideally each provider would have at least two maintainers. It would be nice if the maintainers run the provider in production, but it is not strictly required. Providers in the in-tree providers table that do not have a maintainer listed are in need of assistance.

Read the contributing guidelines and have a look at the contributing docs to learn about building the project, the project structure, and the purpose of each package.

For the release process, see docs/release.md.

For an overview on how to write new Sources and Providers check out Sources and Providers.

Heritage

ExternalDNS is an effort to unify the following similar projects in order to bring the Kubernetes community an easy and predictable way of managing DNS records across cloud providers based on their Kubernetes resources:

Kops' DNS Controller
Zalando's Mate
Molecule Software's route53-kubernetes

User Demo How-To Blogs and Examples

A full demo on GKE Kubernetes. See How-to Kubernetes with DNS management (ssl-manager pre-req)
Run external-dns on GKE with workload identity. See Kubernetes, ingress-nginx, cert-manager & external-dns
[ExternalDNS integration with Az

…(truncated)

View the full README on GitHub

Release history

v0.23.0

v0.22.0

v0.21.0

v0.20.0

v0.19.0

v0.18.0

v0.17.0

README

ExternalDNS

Documentation

What It Does

Running ExternalDNS

Setup Steps

Note

New providers

In-tree providers

Sources

Kubernetes version compatibility

Contributing

Heritage

User Demo How-To Blogs and Examples