Improve RFC links (#8612)

The `tools.ietf.org` site now redirects to `www.rfc-editor.org`.
* Update various URLs to the new site.
* Make links to `www.rfc-editor.org` consistent.

Signed-off-by: SuperQ <superq@gmail.com>

man/coredns-etcd.7

@@ -1,5 +1,5 @@
 .\" Generated by Mmark Markdown Processer - mmark.miek.nl
-.TH "COREDNS-ETCD" 7 "March 2026" "CoreDNS" "CoreDNS Plugins"
+.TH "COREDNS-ETCD" 7 "October 2026" "CoreDNS" "CoreDNS Plugins"
 
 .SH "NAME"
 .PP
@@ -52,6 +52,7 @@ etcd [ZONES...] {
     endpoint ENDPOINT...
     credentials USERNAME PASSWORD
     tls CERT KEY CACERT
+    no\_apex\_fallback
 }
 
 .fi
@@ -85,6 +86,17 @@ file - if the server certificate is not signed by a system-installed CA and clie
 is needed.
 
 .RE
+.IP \(bu 4
+\fB\fCno_apex_fallback\fR disables the legacy zone-root lookup used by address queries and apex-existence
+checks at a configured zone apex. When \fB\fCapex.dns.ZONE\fR does not exist, the lookup returns a name
+error instead of issuing a prefix range over the complete zone subtree. Migrate zone-apex address
+records to the \fB\fCdns/apex\fR layout before enabling this option.
+
+
+.PP
+CoreDNS sets the minimum TLS version to TLS 1.2. The maximum TLS version, TLS 1.2 cipher suites, and
+key exchange mechanisms use the Go \fB\fCcrypto/tls\fR defaults.
+
 .IP \(bu 4
 \fB\fCmin-lease-ttl\fR the minimum TTL for DNS records based on etcd lease duration. Accepts flexible time formats like '30', '30s', '5m', '1h', '2h30m'. Default: 30 seconds.
 .IP \(bu 4
@@ -112,6 +124,27 @@ find entries like \fB\fC/skydns/test/skydns/mx1\fR.
 .PP
 This causes two lookups from CoreDNS to etcd in certain cases.
 
+.SS "BACKEND LOAD"
+.PP
+The \fIetcd\fP plugin does not watch or poll etcd when data changes. Record lookups are driven by
+incoming DNS queries. An uncached lookup may issue multiple etcd requests when an exact-key fallback
+or an internal CNAME lookup is needed.
+
+.PP
+Non-exact lookups use an etcd prefix range and return the complete subtree by design. Querying a name
+high in the hierarchy can therefore read many keys. In particular, an A or AAAA query for a configured
+zone name first looks below \fB\fCapex.dns.ZONE\fR. If that entry does not exist, CoreDNS falls back to the
+zone's root prefix for compatibility with older SkyDNS layouts. On a large zone, that fallback scans
+the entire zone subtree.
+
+.PP
+Store zone-apex address records below the \fB\fCdns/apex\fR path, as shown in the examples below, to avoid
+the zone-wide fallback. Once all apex records use that layout, enable \fB\fCno_apex_fallback\fR to prevent a
+missing or deleted apex entry from triggering a zone-root scan. The \fIcache\fP plugin reduces repeated
+backend reads for the same DNS question, but does not reduce the size of the first prefix response.
+Use the \fIlog\fP plugin to identify the client and question name that trigger a lookup, and
+\fB\fCcoredns_dns_requests_total\fR from the \fIprometheus\fP plugin to measure query volume by zone and type.
+
 .SH "EXAMPLES"
 .PP
 This is the default SkyDNS setup, with everything specified in full:
@@ -189,7 +222,7 @@ endpoint URL depends on the version of \fB\fCetcd\fR. For instance, \fB\fCetcd v
 [CLIENT-URL]/v3alpha/* while \fB\fCetcd v3.5\fR or later uses [CLIENT-URL]/v3/* . Also, Key and Value must
 be base64 encoded in the JSON payload. With \fB\fCetcdctl\fR these details are automatically taken care
 of. You can check this document
-\[la]https://github.com/coreos/etcd/blob/master/Documentation/dev-guide/api_grpc_gateway.md#notes\[ra]
+\[la]https://github.com/etcd-io/website/blob/main/content/en/docs/v3.2/dev-guide/api_grpc_gateway.md\[ra]
 for details.
 
 .SS "REVERSE ZONES"
@@ -244,7 +277,7 @@ create an \fB\fCA\fR record for this zone as follows:
 .RS
 
 .nf
-% etcdctl put /skydns/local/skydns/ '{"host":"1.1.1.1","ttl":60}'
+% etcdctl put /skydns/local/skydns/dns/apex/x1 '{"host":"1.1.1.1","ttl":60}'
 
 .fi
 .RE
@@ -269,8 +302,8 @@ If you would like to use DNS RR for the zone name, you can set the following:
 .RS
 
 .nf
-% etcdctl put /skydns/local/skydns/x1 '{"host":"1.1.1.1","ttl":60}'
-% etcdctl put /skydns/local/skydns/x2 '{"host":"1.1.1.2","ttl":60}'
+% etcdctl put /skydns/local/skydns/dns/apex/x1 '{"host":"1.1.1.1","ttl":60}'
+% etcdctl put /skydns/local/skydns/dns/apex/x2 '{"host":"1.1.1.2","ttl":60}'
 
 .fi
 .RE
@@ -297,8 +330,8 @@ If you would like to use \fB\fCAAAA\fR records for the zone name too, you can se
 .RS
 
 .nf
-% etcdctl put /skydns/local/skydns/x3 '{"host":"2003::8:1","ttl":60}'
-% etcdctl put /skydns/local/skydns/x4 '{"host":"2003::8:2","ttl":60}'
+% etcdctl put /skydns/local/skydns/dns/apex/x3 '{"host":"2003::8:1","ttl":60}'
+% etcdctl put /skydns/local/skydns/dns/apex/x4 '{"host":"2003::8:2","ttl":60}'
 
 .fi
 .RE