iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
ExternalDNS synchronizes DNS records with selected Kubernetes resources by reading their desired hostnames and targets, then reconciling those records through a configured DNS provider. It is a controller—not a DNS server—and it will not automatically register every resource or record in a cluster.
How ExternalDNS connects Kubernetes to DNS
ExternalDNS acts as a reconciliation bridge among three pieces of configuration:
- Sources: Kubernetes resource types it watches, such as Services, Ingresses, Gateway API routes, or other supported sources.
- Desired endpoints: Hostnames, targets, record types, and related details derived from resource status, annotations, and source-specific behavior.
- Provider and ownership registry: A DNS provider receives changes, while a registry helps ExternalDNS identify records it manages.
The project describes its purpose as managing DNS records across cloud providers based on Kubernetes resources. Available sources, providers, flags, defaults, and features can change by release; use documentation matching the deployed version. See the ExternalDNS project and its flag reference.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteChoose what ExternalDNS is allowed to manage
Start by deciding which resource types and records belong in scope. ExternalDNS supports source selection and filtering by labels, domains, and zones. These controls help prevent a controller from changing records outside the intended application or DNS zone.
#1 Best Overall
Filtering behavior is not identical in every case. The project FAQ notes that some filters, including ingress class or annotations, may be applied client-side after ExternalDNS receives resources. Label filtering can be useful when only a subset of resources should reach the controller. Check the exact options and behavior for your release in the flag reference and FAQ.
Set hostnames and targets on supported resources
ExternalDNS derives endpoints according to the selected source. Resource status and annotations can influence the hostname and target; annotation support varies by source. The default annotation prefix is external-dns.kubernetes.io/. Consult the annotation reference for the source you use.
For Gateway API, Gateway resources read the target annotation, while Route resources read hostname, TTL, controller, and provider-specific annotations. Do not assume an annotation used for one source will have the same effect on another. The FAQ also addresses choosing whether records point to a node’s public or private IP when both exist; the correct setting depends on the resource and deployment configuration.
Choose a change policy before enabling writes
The policy determines how ExternalDNS handles records that are no longer desired or already exist:
Rank #3
sync: Allows deletion of managed records that are no longer desired. Removing a Kubernetes resource can therefore clean up its managed DNS record.upsert-only: Creates or updates desired records without deleting records that are no longer desired. Removing a resource leaves its record in place.create-only: Restricts changes to record creation; consult the deployed version’s flag reference for exact behavior and interactions.
Review the provider changes with dry-run before allowing writes. The official getting-started documentation demonstrates --dry-run to print proposed changes. A preview is not proof that credentials work or that live provider writes will succeed.
Protect existing records with ownership tracking
When a zone already contains records, ownership settings are central to avoiding conflicts. A TXT registry is one supported choice; the project also lists AWS service discovery, CRD, DynamoDB, and no-op registry options. For TXT-based ownership, set a unique, stable owner ID and keep it unchanged for the cluster’s lifetime.
CNAME records need special care with TXT ownership because a TXT record cannot share the same name. ExternalDNS documents --txt-prefix as a workaround. Changing that prefix later can make existing records’ ownership unrecognizable, so treat it as part of the persistent configuration rather than a casual adjustment. See the project documentation and latest setup guide.
Recommended Free Tools
Separate public and private DNS views when necessary
For split-horizon DNS, the FAQ describes running separate ExternalDNS instances with different annotation prefixes and public/private zone settings. This can let one Kubernetes resource carry distinct hostnames for separate DNS views. Configure each instance’s scope and provider access so that it manages only its intended zones. The project FAQ covers the approach.
Best Value
Account for provider and version differences
Provider selection is not interchangeable plumbing: confirm the configured provider supports the record types, zone arrangement, and authentication model you need. Also decide whether multiple instances are appropriate, what resource labels or annotations define scope, how frequently reconciliation runs, and which registry and change policy fit the zone.
Provider lists, flags, and defaults are release-sensitive. Match configuration to the ExternalDNS release you deploy rather than copying flags from rolling documentation without checking. The maintainers state that new providers will not be added in-tree and describe webhooks as an extension route. They caution that externally developed webhook providers have not been reviewed by maintainers; presence in a project list is not evidence that a third-party provider is officially vetted. See the project repository and flag reference.
Quick Recap
A safe rollout sequence
- Choose the ExternalDNS release and verify supported sources, provider options, registry choices, and flags in documentation for that release.
- Configure only the Kubernetes sources and zones the controller should manage. Add label, domain, or zone filters where they narrow scope appropriately.
- Set the provider credentials and ownership registry. For TXT ownership, use a unique stable owner ID; if managing CNAMEs, account for TXT name conflicts before selecting a prefix.
- Select a policy deliberately. Use
synconly when automated deletion of no-longer-desired managed records is intended; useupsert-onlywhen removals should not delete records. - Run with
--dry-runand inspect proposed changes for unexpected hostnames, targets, or deletions before enabling live writes. - After reviewing the preview, enable provider writes and monitor the controller and DNS provider for successful reconciliation.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
