prommits/coredns-rrl repository overview

⁠CoreDNS with Response Rate Limiting (RRL)

A CoreDNS Docker image with the RRL (Response Rate Limiting) plugin built-in. RRL provides BIND-like Response Rate Limiting to help mitigate DNS amplification attacks and allows request rate limiting.

⁠Resources

• CoreDNS RRL plugin⁠
• CoreDNS⁠

⁠Tags

• latest - Latest stable release
• 1.x.x - Specific CoreDNS version (e.g., 1.11.1)
• 1.x.x-hash - Build with specific commit hash
• 1.x.x-hash-timestamp - Full unique build tag

Multi-platform: linux/amd64, linux/arm64

⁠What is RRL?

The RRL plugin tracks response rates per category of response and can drop responses when rates exceed configured thresholds. This helps protect your DNS infrastructure from:

• DNS amplification attacks
• Reflection attacks
• DDoS attacks targeting your DNS servers

⁠Quick Start

docker run -d \
  --name coredns-rrl \
  -p 53:53/udp \
  -p 53:53/tcp \
  -v $(pwd)/Corefile:/Corefile \
  prommits/coredns-rrl:latest

⁠Example Corefile

. {
  rrl . {
    responses-per-second 10
    nxdomains-per-second 10
    window 15
    slip-ratio 2
  }
  forward . 8.8.8.8 8.8.4.4
  log
  errors
  cache 30
}

⁠Configuration Options