coredns/coredns · error

transport %s not supported to proxy

Error message

transport %s not supported to proxy

What it means

Connect in plugin/pkg/proxy/connect.go dispatches to lookupDoH for the HTTPS transport and lookupDNS for DNS/TLS; any other transport (e.g. a newly added or unrecognized p.protocol value) has no proxy implementation and hits the default branch, producing this error. It is an unsupported-operation guard, not a runtime failure of an existing transport.

Source

Thrown at plugin/pkg/proxy/connect.go:290

// (localAddr) and the transport proto ("udp" or "tcp") actually used to reach
// the upstream.
func (p *Proxy) Connect(ctx context.Context, state request.Request, opts Options) (*dns.Msg, net.Addr, string, error) {
	start := time.Now()
	originId := state.Req.Id

	var (
		ret       *dns.Msg
		localAddr net.Addr
		proto     string
		err       error
	)
	switch p.protocol {
	case transport.HTTPS:
		ret, localAddr, proto, err = p.lookupDoH(ctx, state, opts)
	case transport.DNS, transport.TLS:
		ret, localAddr, proto, err = p.lookupDNS(ctx, state, opts)
	default:
		return nil, nil, "", fmt.Errorf("transport %s not supported to proxy", p.protocol)
	}
	if err != nil {
		return nil, localAddr, proto, err
	}

	// recovery the origin Id after upstream.
	ret.Id = originId

	rc, ok := dns.RcodeToString[ret.Rcode]
	if !ok {
		rc = strconv.Itoa(ret.Rcode)
	}

	requestDuration.WithLabelValues(p.proxyName, p.addr, rc).Observe(time.Since(start).Seconds())

	return ret, localAddr, proto, nil
}

View on GitHub (pinned to 558c9757a9)

Solutions

1. Change the upstream to a supported scheme: dns://, tls://, or https://.
2. Remove the proxy policy for that upstream or use a transport the proxy supports.
3. Upgrade CoreDNS if you need newer transports via proxy; check release notes for QUIC support.
4. Ensure your code that constructs the proxy sets p.protocol explicitly instead of relying on the zero value.

Example fix

// before
forward . quic://dns.example.com
// after
forward . https://dns.example.com/dns-query

func supportsProxyTransport(p *proxy.Proxy) bool {
  switch p.Protocol() {
  case transport.DNS, transport.TLS, transport.HTTPS:
    return true
  }
  return false
}

When it happens

Trigger: Connect is called (from the proxy/fallback plugin's ServeDNS or tests) with p.protocol set to something other than transport.DNS, transport.TLS, or transport.HTTPS — typically transport.QUIC or an unset/zero-value protocol.

Common situations: Configuring a forward/upstream with a transport type the proxy path doesn't support (e.g. quic:// upstream with proxy policy); code that forgot to set protocol leaving the zero value; CoreDNS versions where QUIC support is absent from the proxy connector.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• ErrInvalidRequest
• dns request rejected
• trimzone: overshot qname: ${q}for zone ${z}
• EDNS0 BADVERS
• no nameservers found

AI-assisted analysis of coredns/coredns@558c9757a9 (2026-09-06). Data as JSON: /api/errors/e755203a040f00b0. Report an issue: GitHub.