#CoreDNS transfer_raw

transfer_raw is an external CoreDNS plugin. It serves a complete, already signed zone file as an authoritative transfer source while ordinary DNS queries continue through the normal CoreDNS chain. NSEC3, DNSKEY, and RRSIG records are preserved verbatim.

This is used to support a DNSSEC blacklie for primary + NSEC3 for AXFR setup.

The file is parsed into an immutable snapshot. Reload checks the SOA serial by default and replaces the snapshot only after successful parsing; reload_by_mtime selects modification-time checks. Errors keep the last valid snapshot, and a missing file is retried while reload is enabled. Changes send NOTIFY through CoreDNS's native transfer plugin.

IXFR is not supported and falls back to the current SOA because no delta history is retained.

#Corefile

example.test {
    transfer_raw /var/lib/coredns/example.test.signed {
        reload 5s
        # reload_by_mtime
    }
    file /var/lib/coredns/example.test.zone example.test
    transfer { to 192.0.2.53 }
}

The custom binary starts from CoreDNS's generated directive list and inserts transfer_raw immediately before transfer, so upstream directive ordering is retained across CoreDNS upgrades. A separate CoreDNS build should add this line before file in its plugin.cfg:

transfer_raw:github.com/cqjjjzr/coredns-transfer_raw

#Build

The repository contains no CoreDNS source. With Go 1.25 or newer installed, run:

go test ./...
go build -o coredns-transfer_raw ./cmd/coredns

The plugin module can also be imported by any CoreDNS checkout through plugin.cfg.

#Maintainer helper

When the pinned CoreDNS version changes, run this helper with Go available:

./tools/sync-main-imports.py
gofmt -w cmd/coredns/main.go
go test ./...