. {
    # Authoritative: load every <zone>.zone in /zones via the auto plugin.
    # Filename pattern (.*)\.zone yields the zone name from the first group.
    # CoreDNS reloads modified files every 30s.
    auto {
        directory /zones (.*)\.zone {1}
        reload 30s
    }

    # Anything not authoritative falls through to upstream resolvers.
    forward . 1.1.1.1 1.0.0.1 9.9.9.9 {
        max_concurrent 1000
    }

    # In-memory cache (TTL clamp 30s for both pos/neg).
    cache 30

    # Operational plugins
    health :8080
    prometheus :9153
    errors
    log
    loop
    reload 10s
}