diff --git a/README.md b/README.md
index ed784cd..6fa5e49 100644
--- a/README.md
+++ b/README.md
@@ -55,7 +55,7 @@ checks all these snippets to see if they are still valid.
 ## New CoreDNS releases
 
 * Sync the notes from the official coredns/coredns repo into this repo by running: `make PLUGINDIR=~coredns/plugin sync`
-* This should update the releases notes in content/blob/coredns-\<version\>.
+* This should update the releases notes in content/blog/coredns-\<version\>.
 * After this step you should manually (never got this to automatically to work) update
-  `date/coredns.toml` and set the latest release in that file and then run `make old` to update the
+  `data/coredns.toml` and set the latest release in that file and then run `make old` to update the
   old(er) HUGO site.
diff --git a/content/blog/coredns-1.8.7.md b/content/blog/coredns-1.8.7.md
new file mode 100644
index 0000000..f9e99ed
--- /dev/null
+++ b/content/blog/coredns-1.8.7.md
@@ -0,0 +1,58 @@
++++
+title = "CoreDNS-1.8.7 Release"
+description = "CoreDNS-1.8.7 Release Notes."
+tags = ["Release", "1.8.7", "Notes"]
+release = "1.8.7"
+date = "2021-12-09T00:00:00+00:00"
+author = "coredns"
++++
+
+This is a release with bug fixes and some new features added. We now enable HTTP/2 in
+gRPC service (https://github.com/coredns/coredns/pull/4842). The shuffling algorithm
+in loadbalance plugin has also been improved to have a more consistent
+behavior (https://github.com/coredns/coredns/pull/4961). This release will also
+log deprecation warnings when wildcard queries are received by kubernetes. The
+wildcard functionality will be completely removed from kubernetes plugin in
+future releases.
+
+
+## Brought to You By
+
+Chris O'Haver,
+Christian Ang,
+Cyb3r Jak3,
+Denis Tingaikin,
+gomakesix,
+Hu Shuai,
+Humberto Leal,
+jayonlau,
+Johnny Bergström,
+LiuCongran,
+Matt Palmer,
+Miek Gieben,
+OctoHuman,
+Ondřej Benkovský,
+Pavol Lieskovský,
+Vector,
+Wu Shuang,
+xuweiwei,
+xww,
+Yong Tang,
+ZhangJian He,
+Zou Nengren
+
+## Noteworthy Changes
+
+* core: Support plain HTTP for DoH (https://github.com/coredns/coredns/pull/4997)
+* plugin/auto: Fix panic caused by config invalid reload value (https://github.com/coredns/coredns/pull/4986)
+* plugin/cache: fix data race (https://github.com/coredns/coredns/pull/4932)
+* plugin/file: Fix print tree error (https://github.com/coredns/coredns/pull/4962)
+* plugin/file: Fix issue of multiple file plugin have same reload time (https://github.com/coredns/coredns/pull/5020)
+* plugin/forward: Use new msg.Id for upstream queries (https://github.com/coredns/coredns/pull/4841)
+* plugin/grpc: Enable HTTP/2 in gRPC service (https://github.com/coredns/coredns/pull/4842)
+* plugin/k8s_external: Fix SRV queries doesn't work with AWS ELB/NLB (https://github.com/coredns/coredns/pull/4929)
+* plugin/kubernetes: Add wildcard warnings (https://github.com/coredns/coredns/pull/5030)
+* plugin/loadbalance: More consistent shuffling (https://github.com/coredns/coredns/pull/4961)
+* plugin/metrics: Support HTTPS qType in requests count metric label (https://github.com/coredns/coredns/pull/4934)
+* plugin/metrics: Expand coredns_dns_responses_total with plugin label (https://github.com/coredns/coredns/pull/4914)
+* plugin/route53: Configurable AWS Endpoint (https://github.com/coredns/coredns/pull/4963)
diff --git a/content/plugins/bind.md b/content/plugins/bind.md
index f9e8862..9d85c8c 100644
--- a/content/plugins/bind.md
+++ b/content/plugins/bind.md
@@ -4,7 +4,7 @@ description = "*bind* overrides the host to which the server should bind."
 weight = 6
 tags = ["plugin", "bind"]
 categories = ["plugin"]
-date = "2021-03-25T15:42:33.8773383"
+date = "2022-01-24T14:51:48.8774881"
 +++
 
 ## Description
@@ -104,3 +104,6 @@ bad.example.com {
     forward . 5.6.7.8
 }
 ```
+
+Also on MacOS there is an (open) bug where this doesn't work properly. See
+<https://github.com/miekg/dns/issues/724> for details, but no solution.
diff --git a/content/plugins/dns64.md b/content/plugins/dns64.md
index 67a69dc..6b1c881 100644
--- a/content/plugins/dns64.md
+++ b/content/plugins/dns64.md
@@ -4,7 +4,7 @@ description = "*dns64* enables DNS64 IPv6 transition mechanism."
 weight = 13
 tags = ["plugin", "dns64"]
 categories = ["plugin"]
-date = "2020-10-28T18:26:48.87748810"
+date = "2022-01-24T14:51:48.8774881"
 +++
 
 ## Description
@@ -30,11 +30,13 @@ Or use this slightly longer form with more options:
 dns64 [PREFIX] {
     [translate_all]
     prefix PREFIX
+    [allow_ipv4]
 }
 ~~~
 
 * `prefix` specifies any local IPv6 prefix to use, instead of the well known prefix (64:ff9b::/96)
 * `translate_all` translates all queries, including responses that have AAAA results.
+* `allow_ipv4` Allow translating queries if they come in over IPv4, default is IPv6 only translation.
 
 ## Examples
 
@@ -73,6 +75,19 @@ Enable translation even if an existing AAAA record is present.
 }
 ~~~
 
+Apply translation even to the requests which arrived over IPv4 network. Warning, the `allow_ipv4` feature will apply
+translations to requests coming from dual-stack clients. This means that a request for a client that sends an `AAAA`
+that would normal result in an `NXDOMAIN` would get a translated result.
+This may cause unwanted IPv6 dns64 traffic when a dualstack client would normally use the result of an `A` record request.
+
+~~~ corefile
+. {
+    dns64 {
+        allow_ipv4
+    }
+}
+~~~
+
 ## Metrics
 
 If monitoring is enabled (via the _prometheus_ plugin) then the following metrics are exported:
diff --git a/content/plugins/forward.md b/content/plugins/forward.md
index 319351a..e5f9b2b 100644
--- a/content/plugins/forward.md
+++ b/content/plugins/forward.md
@@ -4,7 +4,7 @@ description = "*forward* facilitates proxying DNS messages to upstream resolvers
 weight = 20
 tags = ["plugin", "forward"]
 categories = ["plugin"]
-date = "2021-09-21T15:01:04.877489"
+date = "2022-01-24T14:51:48.8774881"
 +++
 
 ## Description
@@ -82,7 +82,9 @@ forward FROM TO... {
 * `tls_servername` **NAME** allows you to set a server name in the TLS configuration; for instance 9.9.9.9
   needs this to be set to `dns.quad9.net`. Multiple upstreams are still allowed in this scenario,
   but they have to use the same `tls_servername`. E.g. mixing 9.9.9.9 (QuadDNS) with 1.1.1.1
-  (Cloudflare) will not work.
+  (Cloudflare) will not work. Using TLS forwarding but not setting `tls_servername` results in anyone
+  being able to man-in-the-middle your connection to the DNS server you are forwarding to. Because of this,
+  it is strongly recommended to set this value when using TLS forwarding.
 * `policy` specifies the policy to use for selecting upstream servers. The default is `random`.
   * `random` is a policy that implements random upstream selection.
   * `round_robin` is a policy that selects hosts based on round robin ordering.
diff --git a/content/plugins/geoip.md b/content/plugins/geoip.md
index 0ab426f..5ae6f34 100644
--- a/content/plugins/geoip.md
+++ b/content/plugins/geoip.md
@@ -4,7 +4,7 @@ description = "*geoip* Lookup maxmind geoip2 databases using the client IP, then
 weight = 21
 tags = ["plugin", "geoip"]
 categories = ["plugin"]
-date = "2021-09-21T15:01:04.877489"
+date = "2022-01-24T14:51:48.8774881"
 +++
 
 ## Description
@@ -48,7 +48,7 @@ The following configuration configures the `City` database.
 }
 ```
 
-## Metadatada Labels
+## Metadata Labels
 A limited set of fields will be exported as labels, all values are stored using strings **regardless of their underlying value type**, and therefore you may have to convert it back to its original type, note that numeric values are always represented in base 10.
 
 | Label                                | Type      | Example          | Description
diff --git a/content/plugins/kubernetes.md b/content/plugins/kubernetes.md
index 8a09b6b..1748856 100644
--- a/content/plugins/kubernetes.md
+++ b/content/plugins/kubernetes.md
@@ -4,7 +4,7 @@ description = "*kubernetes* enables reading zone data from a Kubernetes cluster.
 weight = 28
 tags = ["plugin", "kubernetes"]
 categories = ["plugin"]
-date = "2021-10-08T17:25:26.87726810"
+date = "2022-01-24T14:51:48.8774881"
 +++
 
 ## Description
@@ -201,6 +201,8 @@ packet received by CoreDNS must be the IP address of the Pod that sent the reque
 
 ## Wildcards
 
+**NOTE: Wildcard queries are deprecated** and will no longer be supported in the next minor release.
+
 Some query labels accept a wildcard value to match any value.  If a label is a valid wildcard (\*,
 or the word "any"), then that label will match all values.  The labels that accept wildcards are:
 
diff --git a/content/plugins/metrics.md b/content/plugins/metrics.md
index a494512..5b872de 100644
--- a/content/plugins/metrics.md
+++ b/content/plugins/metrics.md
@@ -1,10 +1,10 @@
 +++
 title = "prometheus"
 description = "*prometheus* enables [Prometheus](https://prometheus.io/) metrics."
-weight = 31
+weight = 34
 tags = ["plugin", "prometheus"]
 categories = ["plugin"]
-date = "2020-03-26T08:18:51.8775183"
+date = "2022-01-24T14:51:48.8774881"
 +++
 
 ## Description
@@ -20,7 +20,7 @@ The following metrics are exported:
 * `coredns_dns_request_size_bytes{server, zone, proto}` - size of the request in bytes.
 * `coredns_dns_do_requests_total{server, zone}` -  queries that have the DO bit set
 * `coredns_dns_response_size_bytes{server, zone, proto}` - response size in bytes.
-* `coredns_dns_responses_total{server, zone, rcode}` - response per zone and rcode.
+* `coredns_dns_responses_total{server, zone, rcode, plugin}` - response per zone, rcode and plugin.
 * `coredns_plugin_enabled{server, zone, name}` - indicates whether a plugin is enabled on per server and zone basis.
 
 Each counter has a label `zone` which is the zonename used for the request/response.
@@ -33,8 +33,10 @@ Extra labels used are:
 * `proto` which holds the transport of the response ("udp" or "tcp")
 * The address family (`family`) of the transport (1 = IP (IP version 4), 2 = IP6 (IP version 6)).
 * `type` which holds the query type. It holds most common types (A, AAAA, MX, SOA, CNAME, PTR, TXT,
-  NS, SRV, DS, DNSKEY, RRSIG, NSEC, NSEC3, IXFR, AXFR and ANY) and "other" which lumps together all
+  NS, SRV, DS, DNSKEY, RRSIG, NSEC, NSEC3, HTTPS, IXFR, AXFR and ANY) and "other" which lumps together all
   other types.
+* the `plugin` label holds the name of the plugin that made the write to the client. If the server
+  did the write (on error for instance), the value is empty.
 
 If monitoring is enabled, queries that do not enter the plugin chain are exported under the fake
 name "dropped" (without a closing dot - this is never a valid domain name).
diff --git a/content/plugins/route53.md b/content/plugins/route53.md
index 6d1672b..5e46523 100644
--- a/content/plugins/route53.md
+++ b/content/plugins/route53.md
@@ -1,10 +1,10 @@
 +++
 title = "route53"
 description = "*route53* enables serving zone data from AWS route53."
-weight = 37
+weight = 42
 tags = ["plugin", "route53"]
 categories = ["plugin"]
-date = "2020-02-06T12:07:03.877382"
+date = "2022-01-24T14:51:48.8774881"
 +++
 
 ## Description
@@ -19,6 +19,7 @@ The route53 plugin can be used when coredns is deployed on AWS or elsewhere.
 ~~~ txt
 route53 [ZONE:HOSTED_ZONE_ID...] {
     aws_access_key [AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY]
+    aws_endpoint ENDPOINT
     credentials PROFILE [FILENAME]
     fallthrough [ZONES...]
     refresh DURATION
@@ -37,6 +38,9 @@ route53 [ZONE:HOSTED_ZONE_ID...] {
     AWS credentials the same way as AWS CLI, e.g., environmental variables, AWS credentials file,
     instance profile credentials, etc.
 
+*   `aws_endpoint` can be used to control the endpoint to use when querying AWS (optional). **ENDPOINT** is the
+    URL of the endpoint to use. If this is not provided the default AWS endpoint resolution will occur.
+
 *   `credentials` is used for reading the credential **FILENAME** and setting the **PROFILE** name for a given
     zone. **PROFILE** is the AWS account profile name. Defaults to `default`. **FILENAME** is the
     AWS credentials filename, defaults to `~/.aws/credentials`.
@@ -78,6 +82,16 @@ example.org {
 }
 ~~~
 
+Enable route53 with an explicit AWS endpoint:
+
+~~~ txt
+example.org {
+    route53 example.org.:Z1Z2Z3Z4DZ5Z6Z7 {
+      aws_endpoint https://test.us-west-2.amazonaws.com
+    }
+}
+~~~
+
 Enable route53 with fallthrough:
 
 ~~~ txt
diff --git a/content/plugins/tls.md b/content/plugins/tls.md
index 5466763..724ac63 100644
--- a/content/plugins/tls.md
+++ b/content/plugins/tls.md
@@ -1,10 +1,10 @@
 +++
 title = "tls"
-description = "*tls* allows you to configure the server certificates for the TLS and gRPC servers."
-weight = 42
+description = "*tls* allows you to configure the server certificates for the TLS, gRPC, DoH servers."
+weight = 46
 tags = ["plugin", "tls"]
 categories = ["plugin"]
-date = "2020-10-28T18:26:48.87748810"
+date = "2022-01-24T14:51:48.8774881"
 +++
 
 ## Description
@@ -60,6 +60,14 @@ grpc://. {
 }
 ~~~
 
+Start a DoH server on port 443 that is similar to the previous example, but using DoH for incoming queries.
+~~~
+https://. {
+	tls cert.pem key.pem ca.pem
+	forward . /etc/resolv.conf
+}
+~~~
+
 Only Knot DNS' `kdig` supports DNS-over-TLS queries, no command line client supports gRPC making
 debugging these transports harder than it should be.
 
diff --git a/content/plugins/transfer.md b/content/plugins/transfer.md
index 5c7fdb2..22a8c7b 100644
--- a/content/plugins/transfer.md
+++ b/content/plugins/transfer.md
@@ -4,7 +4,7 @@ description = "*transfer* perform (outgoing) zone transfers for other plugins."
 weight = 48
 tags = ["plugin", "transfer"]
 categories = ["plugin"]
-date = "2021-09-21T15:01:04.877489"
+date = "2022-01-24T14:51:48.8774881"
 +++
 
 ## Description
@@ -43,7 +43,7 @@ See example below.
 
 ## Examples
 
-Use in conjuction with the _acl_ plugin to restrict access to subnet 10.1.0.0/16.
+Use in conjunction with the _acl_ plugin to restrict access to subnet 10.1.0.0/16.
 
 ```
 ...
diff --git a/data/coredns.toml b/data/coredns.toml
index bdc0a97..e660984 100644
--- a/data/coredns.toml
+++ b/data/coredns.toml
@@ -1,2 +1,2 @@
 [release]
-  version = "1.8.6"
+  version = "1.8.7"