Improve RFC links (#8612)

The `tools.ietf.org` site now redirects to `www.rfc-editor.org`.
* Update various URLs to the new site.
* Make links to `www.rfc-editor.org` consistent.

Signed-off-by: SuperQ <superq@gmail.com>

man/coredns-log.7

@@ -1,5 +1,5 @@
 .\" Generated by Mmark Markdown Processer - mmark.miek.nl
-.TH "COREDNS-LOG" 7 "March 2026" "CoreDNS" "CoreDNS Plugins"
+.TH "COREDNS-LOG" 7 "October 2026" "CoreDNS" "CoreDNS Plugins"
 
 .SH "NAME"
 .PP
@@ -146,7 +146,7 @@ The default Common Log Format is:
 .RE
 
 .PP
-Each of these logs will be outputted with \fB\fClog.Infof\fR, so a typical example looks like this:
+In the default text mode, each of these logs is output with \fB\fClog.Info\fR, so a typical example looks like this:
 
 .PP
 .RS
@@ -157,6 +157,60 @@ Each of these logs will be outputted with \fB\fClog.Infof\fR, so a typical examp
 .fi
 .RE
 
+.SH "JSON OUTPUT"
+.PP
+Start CoreDNS with \fB\fC-log-format=json\fR to select JSON output for the entire process.
+This is a command-line flag, not a Corefile directive. \fB\fC-log-format=text\fR is the default.
+The \fB\fClog\fR plugin's name and response-class filters work identically in both modes.
+
+.PP
+Each query produces one JSON record with common fields \fB\fCtime\fR, \fB\fClevel\fR, \fB\fCmsg\fR, and
+\fB\fCplugin\fR (always \fB\fClog\fR for query records), plus these typed fields:
+
+.RS
+.TS
+allbox;
+l l l 
+l l l .
+\fBField\fP\fB	Type\fP\fB	Meaning\fP
+\fB\fCclient_ip\fR	string	Client address, without brackets around IPv6 addresses
+\fB\fCclient_port\fR	number	Client port
+\fB\fCqname\fR	string	Lowercase, fully qualified query name, in DNS presentation format
+\fB\fCqtype\fR, \fB\fCqclass\fR	string	Query type and class, including numeric forms for unknown values
+\fB\fCprotocol\fR	string	\fB\fCudp\fR or \fB\fCtcp\fR, as for \fB\fC{proto}\fR
+\fB\fCid\fR, \fB\fCopcode\fR	number	Query ID and opcode
+\fB\fCrequest_size\fR	number	Request size in bytes, as for \fB\fC{size}\fR
+\fB\fCdnssec_ok\fR	boolean	Query's DNSSEC OK bit
+\fB\fCbufsize\fR	number	Effective response buffer size, as for \fB\fC{>bufsize}\fR
+\fB\fCrcode\fR	string or null	Response RCODE, or null if no DNS response was recorded
+\fB\fCresponse_size\fR	number	Recorded response size in bytes, as for \fB\fC{rsize}\fR
+\fB\fCduration_seconds\fR	number	Elapsed handling time in seconds
+.TE
+.RE
+
+
+.PP
+As in text mode, response sizes describe recorded, uncompressed messages, not
+necessarily the bytes delivered to the client. Deferred errors (such as SERVFAIL)
+use the response CoreDNS will generate after the plugin chain returns. A dropped
+request has \fB\fCrcode: null\fR; it is not logged as a successful response. Raw \fB\fCWrite\fR
+calls contribute to the size but do not provide a decoded response RCODE.
+
+.PP
+\fB\fCFORMAT\fR still controls \fB\fCmsg\fR, including custom formats and metadata placeholders.
+It does not replace the JSON schema or define new top-level fields. The DNS fields
+come directly from the request and response, not from parsing \fB\fCmsg\fR. For example,
+with \fB\fClog . "{name} {rcode}"\fR:
+
+.PP
+.RS
+
+.nf
+{"time":"2026\-09\-15T08:00:00Z","level":"INFO","msg":"example.org. NOERROR","plugin":"log","client\_ip":"127.0.0.1","client\_port":40212,"qname":"example.org.","qtype":"A","qclass":"IN","protocol":"udp","id":42,"opcode":0,"request\_size":29,"dnssec\_ok":false,"bufsize":512,"rcode":"NOERROR","response\_size":29,"duration\_seconds":0.001}
+
+.fi
+.RE
+
 .SH "ADDITIONAL METADATA"
 .PP
 The log plugin adds the following metadata to allow for granular differentiation of NOERROR denial vs success messages. These are mapped from \fB\fCplugin/pkg/response/classify.go\fR and \fB\fCplugin/pkg/response/typify.go\fR.