I want CoreDNS to forward to Windows 2016 AD DNS services using a subdomain (k8s.ad.mydomain.com). I have the delegate created, I have an NS record (though it says it is not authoritative), and I have my entry in the CoreDNS ConfigMap with the IPs to the forwarders.

Is the error about not being authoritative inevitable or is it a misconfiguration?

# Please edit the object below. Lines beginning with a '#' will be ignored,
# and an empty file will abort the edit. If an error occurs while saving this file will be
# reopened with the relevant failures.
apiVersion: v1
  Corefile: |
    k8s.ad-domain.domain.com:53 {
       kubernetes cluster.local {
           pods insecure
       k8s_external ad-domain.domain.com

    .:53 {
        health {
           lameduck 5s
        kubernetes cluster.local in-addr.arpa ip6.arpa {
           pods insecure
           fallthrough in-addr.arpa ip6.arpa
           ttl 30
        prometheus :9153
        forward . /etc/resolv.conf
        cache 30
kind: ConfigMap
  name: coredns
  namespace: kube-system
  • Hi, could you please add the CoreDNS configmap of your setup so it could be used for reproduction purposes? Also, adding to that, could you please explain more your setup and where are you getting this error (are you getting it in the specific command like dig or nslookup)? – Dawid Kruk May 10 at 13:33
  • When I run dig, no CNAME or A records return an IP when going to k8s.ad-domain.domain.com – Manchuwook May 10 at 16:57
  • Can you please describe briefly an expected flow of your DNS query, is it something like this: (out-cluster)-> k8s.ad-domain.domain.com [ ad-domain.domain.com sub-domain delagated at your DNS provider] -> (External IP of CoreDNS Svc) --- forward ---> (Windows Server DNS Services) ? – Dawid Kruk May 14 at 12:25
  • Few more things, 1. Is address reachable from within the cluster ? Are you able query Windows Server DNS Services from inside the cluster right now ? e.g $ dig -p 53 @ ad-domain.domain.com? 2. Forward rule: "forward" What is FROM address ( in your case ? 3. Please tell us something more about your K8S setup and CoreDNS version. – Dawid Kruk May 14 at 12:25
  • The IP of the k8s host server is netmask (or /21) and I have two DNS & ...97. When I do the dig command, it does return an A record with the resolved answers to IPs. I installed the dnsutils busybox image and ran kubectl exec -i -t dnsutils -- dig -p 53 @ ad-domain.domain.com and it resolved the A records correctly as well. I had installed the node using kubeadm so it uses the CoreDNS that came with kubeadm (1.21.0). SInce you had mentioned the FROM, I noticed that as well and made it forward . – Manchuwook May 22 at 15:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.