Free tools Windows power users keep installed
One-click scans. No signup required.
ExternalDNS synchronizes DNS records with selected Kubernetes resources by translating their hostnames and targets into changes for a configured DNS provider. To use it safely, choose the resources it watches, the provider and ownership registry, the records it may manage, and whether obsolete records can be deleted.
How ExternalDNS connects Kubernetes to DNS
ExternalDNS is a controller, not a DNS server. It observes configured Kubernetes sources, derives desired DNS endpoints from their state and configuration, then reconciles those endpoints with a DNS provider API. It does not automatically register every hostname or record in a cluster.
As an Amazon Associate I earn from qualifying purchases.
The setup has three parts:
- Sources: Select the resource types ExternalDNS reads, such as Services, Ingresses, Gateway API routes, or other supported sources.
- Desired endpoints: Hostnames, targets, record types, and related details are derived from resource status, annotations, and source-specific behavior.
- Provider and registry: The configured provider receives record changes, while the registry helps ExternalDNS identify records it owns.
Available sources, provider features, defaults, and flags can change between releases. Check the documentation matching the deployed version rather than assuming the rolling project documentation describes every release. See the ExternalDNS project and its flag reference.
Decide what it is allowed to manage
Scope is the first safety decision: determine which resources and DNS names the controller can affect. ExternalDNS provides controls for source selection, resource labels, domain filters, and zone filters. Use the narrowest scope that matches the intended records.
#1 Best Overall
- Choose only the required source types.
- Use label filtering when only a subset of resources should be passed to the controller.
- Restrict eligible names with domain filters and, where appropriate, zone filters.
- Check source-specific controls, such as ingress class or annotations, against the deployed version.
Some filters, including certain ingress-class or annotation checks, may be applied client-side after ExternalDNS has received resources. Label filters can limit which resources are passed to the controller. Consult the project FAQ and flags documentation for the behavior of the version in use.
Choose the source and annotate resources appropriately
Each source has its own rules for deriving DNS endpoints. An annotation that is meaningful for one resource type may not have the same effect on another. The default annotation prefix is external-dns.kubernetes.io/; annotation support varies by source. The annotation reference documents the supported annotations.
Rank #2
For Gateway API, Gateway resources read the target annotation, while Route resources read hostname, TTL, controller, and provider-specific annotations. Confirm the exact resource behavior and API versions supported by your ExternalDNS release before relying on an annotation.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Choose provider, registry, and change policy
The provider determines which DNS API receives changes and which provider-specific features are available. The registry and policy determine how ExternalDNS identifies ownership and handles records. These settings are operational choices, not interchangeable defaults.
| Decision | What to verify |
|---|---|
| Provider | Provider support for the required zones, record types, and configuration in the deployed release. |
| Registry | How ownership is recorded; documented options include TXT, CRD, DynamoDB, AWS service discovery, and no-op, with availability depending on version and provider. |
| Change policy | sync can delete records no longer desired; upsert-only does not delete records. Other policies and exact options should be checked in the relevant release documentation. |
| Credentials and scope | Whether the controller’s credentials can make the intended changes only in the intended account, zone, and environment. |
For a non-empty zone, use ownership tracking deliberately. With a TXT registry, set a unique, stable owner ID and keep it unchanged for the cluster’s lifetime. If managing CNAME records, configure a TXT prefix to avoid a name conflict: a TXT record cannot share the CNAME’s name. Changing the prefix later can prevent ExternalDNS from recognizing ownership of records it created. Check the ExternalDNS documentation and version-specific flags before applying registry settings.
Preview changes before allowing provider writes
Run ExternalDNS in dry-run mode first and inspect the proposed changes. The official getting-started material demonstrates --dry-run as a way to print the changes the controller would submit. Treat this as a preview, not proof that credentials or live provider writes work.
Rank #4
- Configure the intended source, provider, registry, owner ID, policy, and scope filters.
- Run with
--dry-runand review every proposed hostname, target, and change. - Correct unexpected names or targets by revisiting source behavior, annotations, and filters.
- Only after the preview is acceptable, remove dry-run mode and monitor the controller and provider for actual results.
With --policy=sync, removing a Kubernetes resource can result in cleanup of its managed DNS record. With upsert-only, the record remains after the resource is removed, so plan for any cleanup that may be needed. The getting-started guide describes dry-run and policy behavior.
Recommended Free Tools
Handle public and private DNS views
If a hostname needs different answers inside and outside a network, the project FAQ describes running separate ExternalDNS instances with different annotation prefixes and public/private zone settings. A resource can then carry distinct hostnames for the separate DNS views. Keep each instance’s scope, credentials, and ownership configuration distinct enough to avoid unintended overlap. See the FAQ for the documented approach.
Check provider extensions and cross-account setups
Provider support does not mean every provider feature or account arrangement works identically. Confirm the provider’s zone and credential requirements for the version and deployment you operate. The project FAQ includes the question of managing a hosted zone in another AWS account, but the answer depends on the setup; do not infer cross-account access from ExternalDNS support for a provider alone.
Maintainers state that new providers will not be added in-tree and describe webhooks as an extension route. Third-party webhook providers are not thereby officially supported or reviewed by maintainers. Evaluate their code, permissions, maintenance, and compatibility independently. Further details are in the project repository.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
