Skip to content
Cloudflare Docs
Docs DirectoryAPIsSDKs

Changelog

New updates and improvements at Cloudflare.

Subscribe to RSS View RSS feeds
Application performance
hero image

  1. Smart Tiered Cache optimizes public cloud origins

    Cache / CDN

    You can now achieve higher cache HIT rates and reduce origin load for origins hosted on public cloud providers with Smart Tiered Cache. By setting a cloud region hint for your origin, Cloudflare selects the optimal upper-tier data center for that cloud region, funneling all cache MISSes through a single location close to your origin.

    Previously, Smart Tiered Cache could not reliably select an optimal upper tier for origins behind anycast or regional unicast networks commonly used by cloud providers. Origins on AWS, GCP, Azure, and Oracle Cloud would fall back to a multi-upper-tier topology, resulting in lower cache HIT rates and more requests reaching your origin.

    How it works

    Set a cloud region hint (for example, aws/us-east-1 or gcp/europe-west1) for your origin IP or hostname. Smart Tiered Cache uses this hint along with real-time latency data to select a primary upper tier close to your cloud region, plus a fallback in a different location for resilience.

    • Supported providers: AWS, GCP, Azure, and Oracle Cloud.
    • All plans: Available on Free, Pro, Business, and Enterprise plans at no additional cost.
    • Dashboard and API: Configure from Caching > Tiered Cache > Origin Configuration, or use the API and Terraform.

    Get started

    To get started, enable Smart Tiered Cache and set a cloud region hint for your origin in the Tiered Cache settings.

  1. Manage mTLS and BYO CA certificates from the Cloudflare dashboard

    SSL/TLS

    You can now manage mutual TLS (mTLS) and Bring Your Own Certificate Authority (BYO CA) configurations directly from the Cloudflare dashboard — no API required.

    Previously, these advanced workflows required the Cloudflare API. The following are now available in the dashboard:

    • AOP certificate management — Upload and manage your own certificate authorities for Authenticated Origin Pulls (AOP) directly from the dashboard.
    • BYO Client mTLS certificate management — Upload and manage your own CA certificates for client mTLS enforcement without needing API access.
    • CDN hostname to client mTLS certificate mapping — Associate client mTLS certificates with specific hostnames directly from the dashboard.

  1. New QUIC RTT and delivery rate fields

    Rules

    Two new fields are now available in rule expressions that surface Layer 4 transport telemetry from the client connection. Together with the existing cf.timings.client_tcp_rtt_msec field, these fields give you a complete picture of connection quality for both TCP and QUIC traffic — enabling transport-aware rules without requiring any client-side changes.

    Previously, QUIC RTT and delivery rate data was only available via the Server-Timing: cfL4 response header. These new fields make the same data available directly in rule expressions, so you can use them in Transform Rules, WAF Custom Rules, and other phases that support dynamic fields.

    New fields

    FieldTypeDescription
    cf.timings.client_quic_rtt_msecIntegerThe smoothed QUIC round-trip time (RTT) between Cloudflare and the client in milliseconds. Only populated for QUIC (HTTP/3) connections. Returns 0 for TCP connections.
    cf.edge.l4.delivery_rateIntegerThe most recent data delivery rate estimate for the client connection, in bytes per second. Returns 0 when L4 statistics are not available for the request.

    Example: Route slow connections to a lightweight origin

    Use a request header transform rule to tag requests from high-latency connections, so your origin can serve a lighter page variant:

    Rule expression:

    cf.timings.client_tcp_rtt_msec > 200 or cf.timings.client_quic_rtt_msec > 200

    Header modifications:

    OperationHeader nameValue
    SetX-High-Latencytrue

    Example: Match low-bandwidth connections

    cf.edge.l4.delivery_rate > 0 and cf.edge.l4.delivery_rate < 100000

    For more information, refer to Request Header Transform Rules and the fields reference.

  1. Internal DNS - now in open beta

    DNS

    Internal DNS is now in open beta.

    Who can use it?

    Internal DNS is bundled as a part of Cloudflare Gateway and is now available to every Enterprise customer with one of the following subscriptions:

    • Cloudflare Zero Trust Enterprise
    • Cloudflare Gateway Enterprise

    To learn more and get started, refer to the Internal DNS documentation.

  1. New mTLS certificate fields for Transform Rules

    Rules

    Cloudflare now exposes four new fields in the Transform Rules phase that encode client certificate data in RFC 9440 ↗ format. Previously, forwarding client certificate information to your origin required custom parsing of PEM-encoded fields or non-standard HTTP header formats. These new fields produce output in the standardized Client-Cert and Client-Cert-Chain header format defined by RFC 9440, so your origin can consume them directly without any additional decoding logic.

    Each certificate is DER-encoded, Base64-encoded, and wrapped in colons. For example, :MIIDsT...Vw==:. A chain of intermediates is expressed as a comma-separated list of such values.

    New fields

    FieldTypeDescription
    cf.tls_client_auth.cert_rfc9440StringThe client leaf certificate in RFC 9440 format. Empty if no client certificate was presented.
    cf.tls_client_auth.cert_rfc9440_too_largeBooleantrue if the leaf certificate exceeded 10 KB and was omitted. In practice this will almost always be false.
    cf.tls_client_auth.cert_chain_rfc9440StringThe intermediate certificate chain in RFC 9440 format as a comma-separated list. Empty if no intermediate certificates were sent or if the chain exceeded 16 KB.
    cf.tls_client_auth.cert_chain_rfc9440_too_largeBooleantrue if the intermediate chain exceeded 16 KB and was omitted.

    The chain encoding follows the same ordering as the TLS handshake: the certificate closest to the leaf appears first, working up toward the trust anchor. The root certificate is not included.

    Example: Forwarding client certificate headers to your origin server

    Add a request header transform rule to set the Client-Cert and Client-Cert-Chain headers on requests forwarded to your origin server. For example, to forward headers for verified, non-revoked certificates:

    Rule expression:

    cf.tls_client_auth.cert_verified and not cf.tls_client_auth.cert_revoked

    Header modifications:

    OperationHeader nameValue
    SetClient-Certcf.tls_client_auth.cert_rfc9440
    SetClient-Cert-Chaincf.tls_client_auth.cert_chain_rfc9440

    To get the most out of these fields, upload your client CA certificate to Cloudflare so that Cloudflare validates the client certificate at the edge and populates cf.tls_client_auth.cert_verified and cf.tls_client_auth.cert_revoked.

    For more information, refer to Mutual TLS authentication, Request Header Transform Rules, and the fields reference.

  1. Cache Response Rules

    Cache / CDN

    You can now control how Cloudflare handles origin responses without changing your origin. Cache Response Rules let you modify Cache-Control directives, manage cache tags, and strip headers like Set-Cookie from origin responses before they reach Cloudflare's cache. Whether traffic is cached or passed through dynamically, these rules give you control over origin response behavior that was previously out of reach.

    What changed

    Cache Rules previously only operated on request attributes. Cache Response Rules introduce a new response phase that evaluates origin responses and lets you act on them before caching. You can now:

    • Modify Cache-Control directives: Set or remove individual directives like no-store, no-cache, max-age, s-maxage, stale-while-revalidate, immutable, and more. For example, remove a no-cache directive your origin sends so Cloudflare can cache the asset, or set an s-maxage to control how long Cloudflare stores it.
    • Set a different browser Cache-Control: Send a different Cache-Control header downstream to browsers and other clients than what Cloudflare uses internally, giving you independent control over edge and browser caching strategies.
    • Manage cache tags: Add, set, or remove cache tags on responses, including converting tags from another CDN's header format into Cloudflare's Cache-Tag header. This is especially useful if you are migrating from a CDN that uses a different tag header or delimiter.
    • Strip headers that block caching: Remove Set-Cookie, ETag, or Last-Modified headers from origin responses before caching, so responses that would otherwise be treated as uncacheable can be stored and served from cache.

    Benefits

    • No origin changes required: Fix caching behavior entirely from Cloudflare, even when your origin configuration is locked down or managed by a different team.
    • Simpler CDN migration: Match caching behavior from other CDN providers without rewriting your origin. Translate cache tag formats and override directives that do not align with Cloudflare's defaults.
    • Native support, fewer workarounds: Functionality that previously required workarounds is now built into Cache Rules with full Tiered Cache compatibility.
    • Fine-grained control: Use expressions to match on request and response attributes, then apply precise cache settings per rule. Rules are stackable and composable with existing Cache Rules.

    Get started

    Configure Cache Response Rules in the Cloudflare dashboard ↗ under Caching > Cache Rules, or via the Rulesets API ↗. For more details, refer to the Cache Rules documentation ↗.

  1. DNS Analytics for Customer Metadata Boundary set to EU region

    DNS

    DNS Analytics is now available for customers with Customer Metadata Boundary (CMB) set to EU. Query your DNS analytics data while keeping metadata stored in the EU region.

    This update includes:

    • DNS Analytics — Access the same DNS analytics experience for zones in CMB=EU accounts.
    • EU data residency — Analytics data is stored and queried from the EU region, meeting data localization requirements.
    • DNS Firewall Analytics — DNS Firewall analytics is now supported for CMB=EU customers.

    Availability

    Available to customers with the Data Localization Suite who have Customer Metadata Boundary configured for the EU region.

    Where to find it

    • Authoritative DNS: In the Cloudflare dashboard, select your zone and go to the Analytics page.

      Go to Analytics

    • DNS Firewall: In the Cloudflare dashboard, go to the DNS Firewall Analytics page.

      Go to Analytics

    For more information, refer to DNS Analytics and DNS Firewall Analytics.

  1. Worker execution timing field now available in Rules

    Rules

    The cf.timings.worker_msec field is now available in the Ruleset Engine. This field reports the wall-clock time that a Cloudflare Worker spent handling a request, measured in milliseconds.

    You can use this field to identify slow Worker executions, detect performance regressions, or build rules that respond differently based on Worker processing time, such as logging requests that exceed a latency threshold.

    Field details

    FieldTypeDescription
    cf.timings.worker_msecIntegerThe time spent executing a Cloudflare Worker in milliseconds. Returns 0 if no Worker was invoked.

    Example filter expression:

    cf.timings.worker_msec > 500

    For more information, refer to the Fields reference.

  1. Asynchronous stale-while-revalidate

    Cache / CDN

    Cloudflare's stale-while-revalidate support is now fully asynchronous. Previously, the first request for a stale (expired) asset in cache had to wait for an origin response, after which that visitor received a REVALIDATED or EXPIRED status. Now, the first request after the asset expires triggers revalidation in the background and immediately receives stale content with an UPDATING status. All following requests also receive stale content with an UPDATING status until the origin responds, after which subsequent requests receive fresh content with a HIT status.

    stale-while-revalidate is a Cache-Control directive set by your origin server that allows Cloudflare to serve an expired cached asset while a fresh copy is fetched from the origin.

    Asynchronous revalidation brings:

    • Lower latency: No visitor is waiting for the origin when the asset is already in cache. Every request is served from cache during revalidation.
    • Consistent experience: All visitors receive the same cached response during revalidation.
    • Reduced error exposure: The first request is no longer vulnerable to origin timeouts or errors. All visitors receive a cached response while revalidation happens in the background.

    Availability

    This change is live for all Free, Pro, and Business zones. Approximately 75% of Enterprise zones have been migrated, with the remaining zones rolling out throughout the quarter.

    Get started

    To use this feature, make sure your origin includes the stale-while-revalidate directive in the Cache-Control header. Refer to the Cache-Control documentation for details.

  1. Control request and response body buffering in Configuration Rules

    Rules

    You can now control how Cloudflare buffers HTTP request and response bodies using two new settings in Configuration Rules.

    Request body buffering

    Controls how Cloudflare buffers HTTP request bodies before forwarding them to your origin server:

    ModeBehavior
    Standard (default)Cloudflare can inspect a prefix of the request body for enabled functionality such as WAF and Bot Management.
    FullBuffers the entire request body before sending to origin.
    NoneNo buffering — the request body streams directly to origin without inspection.

    Response body buffering

    Controls how Cloudflare buffers HTTP response bodies before forwarding them to the client:

    ModeBehavior
    Standard (default)Cloudflare can inspect a prefix of the response body for enabled functionality.
    NoneNo buffering — the response body streams directly to the client without inspection.

    API example

    {
      "action": "set_config",
      "action_parameters": {
        "request_body_buffering": "standard",
        "response_body_buffering": "none"
      }
    }

    For more information, refer to Configuration Rules.

  1. New cryptographic functions — encode_base64() and sha256()

    Rules

    Cloudflare Rulesets now includes encode_base64() and sha256() functions, enabling you to generate signed request headers directly in rule expressions. These functions support common patterns like constructing a canonical string from request attributes, computing a SHA256 digest, and Base64-encoding the result.

    New functions

    FunctionDescriptionAvailability
    encode_base64(input, flags)Encodes a string to Base64 format. Optional flags parameter: u for URL-safe encoding, p for padding (adds = characters to make the output length a multiple of 4, as required by some systems). By default, output is standard Base64 without padding.All plans (in header transform rules)
    sha256(input)Computes a SHA256 hash of the input string.Requires enablement

    Examples

    Encode a string to Base64 format:

    encode_base64("hello world")

    Returns: aGVsbG8gd29ybGQ

    Encode a string to Base64 format with padding:

    encode_base64("hello world", "p")

    Returns: aGVsbG8gd29ybGQ=

    Perform a URL-safe Base64 encoding of a string:

    encode_base64("hello world", "u")

    Returns: aGVsbG8gd29ybGQ

    Compute the SHA256 hash of a secret token:

    sha256("my-token")

    Returns a hash that your origin can validate to authenticate requests.

    Compute the SHA256 hash of a string and encode the result to Base64 format:

    encode_base64(sha256("my-token"))

    Combines hashing and encoding for systems that expect Base64-encoded signatures.

    For more information, refer to the Functions reference.

  1. New functions for array and map operations

    Rules

    New functions for array and map operations

    Cloudflare Rulesets now include new functions that enable advanced expression logic for evaluating arrays and maps. These functions allow you to build rules that match against lists of values in request or response headers, enabling use cases like country-based blocking using custom headers.

    New functions

    FunctionDescription
    split(source, delimiter)Splits a string into an array of strings using the specified delimiter.
    join(array, delimiter)Joins an array of strings into a single string using the specified delimiter.
    has_key(map, key)Returns true if the specified key exists in the map.
    has_value(map, value)Returns true if the specified value exists in the map.

    Example use cases

    Check if a country code exists in a header list:

    has_value(split(http.response.headers["x-allow-country"][0], ","), ip.src.country)

    Check if a specific header key exists:

    has_key(http.request.headers, "x-custom-header")

    Join array values for logging or comparison:

    join(http.request.headers.names, ", ")

    For more information, refer to the Functions reference.

  1. Metro code field now available in Rules

    Rules

    The ip.src.metro_code field in the Ruleset Engine is now populated with DMA (Designated Market Area) data.

    You can use this field to build rules that target traffic based on geographic market areas, enabling more granular location-based policies for your applications.

    Field details

    FieldTypeDescription
    ip.src.metro_codeString | nullThe metro code (DMA) of the incoming request's IP address. Returns the designated market area code for the client's location.

    Example filter expression:

    ip.src.metro_code eq "501"

    For more information, refer to the Fields reference.

  1. Audit Logs for Cache Purge Events

    Cache / CDN

    You can now review detailed audit logs for cache purge events, giving you visibility into what purge requests were sent, what they contained, and by whom. Audit your purge requests via the Dashboard or API for all purge methods:

    • Purge everything
    • List of prefixes
    • List of tags
    • List of hosts
    • List of files

    Example

    The detailed audit payload is visible within the Cloudflare Dashboard (under Manage Account > Audit Logs) and via the API. Below is an example of the Audit Logs v2 payload structure:

    {
      "action": {
        "result": "success",
        "type": "create"
      },
      "actor": {
        "id": "1234567890abcdef",
        "email": "user@example.com",
        "type": "user"
      },
      "resource": {
        "product": "purge_cache",
        "request": {
          "files": [
            "https://example.com/images/logo.png",
            "https://example.com/css/styles.css"
          ]
        }
      },
      "zone": {
        "id": "023e105f4ecef8ad9ca31a8372d0c353",
        "name": "example.com"
      }
    }

    Get started

    To get started, refer to the Audit Logs documentation.

  1. Inspect Cache Keys with Cloudflare Trace

    Cache / CDN

    You can now see the exact cache key generated for any request directly in Cloudflare Trace. This visibility helps you troubleshoot cache hits and misses, and verify that your Custom Cache Keys — configured via Cache Rules or Page Rules — are working as intended.

    Previously, diagnosing caching behavior required inferring the key from configuration settings. Now, you can confirm that your custom logic for headers, query strings, and device types is correctly applied.

    Access Trace via the dashboard or API, either manually for ad-hoc debugging or automated as part of your quality-of-service monitoring.

    Example scenario

    If you have a Cache Rule that segments content based on a specific cookie (for example, user_region), run a Trace with that cookie present to confirm the user_region value appears in the resulting cache key.

    The Trace response includes the cache key in the cache object:

    {
      "step_name": "request",
      "type": "cache",
      "matched": true,
      "public_name": "Cache Parameters",
      "cache": {
        "key": {
          "zone_id": "023e105f4ecef8ad9ca31a8372d0c353",
          "scheme": "https",
          "host": "example.com",
          "uri": "/images/hero.jpg"
        },
        "key_string": "023e105f4ecef8ad9ca31a8372d0c353::::https://example.com/images/hero.jpg:::::"
      }
    }

    Get started

    To learn more, refer to the Trace documentation and our guide on Custom Cache Keys.

  1. New TCP-based fields available in Rulesets

    Rules

    Build rules based on TCP transport and latency

    Cloudflare now provides two new request fields in the Ruleset engine that let you make decisions based on whether a request used TCP and the measured TCP round-trip time between the client and Cloudflare. These fields help you understand protocol usage across your traffic and build policies that respond to network performance. For example, you can distinguish TCP from QUIC traffic or route high latency requests to alternative origins when needed.

    New fields

    FieldTypeDescription
    cf.edge.client_tcpBooleanIndicates whether the request used TCP. A value of true means the client connected using TCP instead of QUIC.
    cf.timings.client_tcp_rtt_msecNumberReports the smoothed TCP round-trip time between the client and Cloudflare in milliseconds. For example, a value of 20 indicates roughly twenty milliseconds of RTT.

    Example filter expression:

    cf.edge.client_tcp && cf.timings.client_tcp_rtt_msec < 100

    More information can be found in the Rules language fields reference.

  1. Monitor Groups for Advanced Health Checking With Load Balancing

    Load Balancing

    Cloudflare Load Balancing now supports Monitor Groups, a powerful new way to combine multiple health monitors into a single, logical group. This allows you to create sophisticated health checks that more accurately reflect the true availability of your applications by assessing multiple services at once.

    With Monitor Groups, you can ensure that all critical components of an application are healthy before sending traffic to an origin pool, enabling smarter failover decisions and greater resilience. This feature is now available via the API for customers with an Enterprise Load Balancing subscription.

    What you can do:

    • Combine Multiple Monitors: Group different health monitors (for example, HTTP, TCP) that check various application components, like a primary API gateway and a specific /login service.
    • Isolate Monitors for Observation: Mark a monitor as "monitoring only" to receive alerts and data without it affecting a pool's health status or traffic steering. This is perfect for testing new checks or observing non-critical dependencies.
    • Improve Steering Intelligence: Latency for Dynamic Steering is automatically averaged across all active monitors in a group, providing a more holistic view of an origin's performance.

    This enhancement is ideal for complex, multi-service applications where the health of one component depends on another. By aggregating health signals, Monitor Groups provide a more accurate and comprehensive assessment of your application's true status.

    For detailed information and API configuration guides, please visit our developer documentation for Monitor Groups.

  1. DNS Firewall Analytics — now in the Cloudflare dashboard

    DNS

    What's New

    Access GraphQL-powered DNS Firewall analytics directly in the Cloudflare dashboard.

    DNS Firewall Analytics UI

    Explore Four Interactive Panels

    • Query summary: Describes trends over time, segmented by dimensions.
    • Query statistics: Describes totals, cached/uncached queries, and processing/response times.
    • DNS queries by data center: Describes global view and the top 10 data centers.
    • Top query statistics: Shows a breakdown by key dimensions, with search and expand options (up to top 100 items).

    Additional features:

    • Apply filters and time ranges once. Changes reflect across all panels.
    • Filter by dimensions like query name, query type, cluster, data center, protocol (UDP/TCP), IP version, response code/reason, and more.
    • Access up to 62 days of historical data with flexible intervals.

    Availability

    Available to all DNS Firewall customers as part of their existing subscription.

    Where to Find It

  1. Smart Tiered Cache Fallback to Generic

    Cache / CDN

    Smart Tiered Cache now falls back to Generic Tiered Cache when the origin location cannot be determined, improving cache precision for your content.

    Previously, when Smart Tiered Cache was unable to select the optimal upper tier (such as when origins are masked by Anycast IPs), latency could be negatively impacted. This fallback now uses Generic Tiered Cache instead, providing better performance and cache efficiency.

    How it works

    When Smart Tiered Cache falls back to Generic Tiered Cache:

    1. Multiple upper-tiers: Uses all of Cloudflare's global data centers as a network of upper-tiers instead of a single optimal location.
    2. Distributed cache requests: Lower-tier data centers can query any available upper-tier for cached content.
    3. Improved global coverage: Provides better cache hit ratios across geographically distributed visitors.
    4. Automatic fallback: Seamlessly transitions when origin location cannot be determined, such as with Anycast-masked origins.

    Benefits

    • Preserves high performance during fallback: Smart Tiered Cache now maintains strong cache efficiency even when optimal upper tier selection is not possible.
    • Minimizes latency impact: Automatically uses Generic Tiered Cache topology to keep performance high when origin location cannot be determined.
    • Seamless experience: No configuration changes or intervention required when fallback occurs.
    • Improved resilience: Smart Tiered Cache remains effective across diverse origin infrastructure, including Anycast-masked origins.

    Get started

    This improvement is automatically applied to all zones using Smart Tiered Cache. No action is required on your part.

  1. Manage and deploy your AI provider keys through Bring Your Own Key (BYOK) with AI Gateway, now powered by Cloudflare Secrets Store

    Secrets Store AI Gateway SSL/TLS

    Cloudflare Secrets Store is now integrated with AI Gateway, allowing you to store, manage, and deploy your AI provider keys in a secure and seamless configuration through Bring Your Own Key ↗. Instead of passing your AI provider keys directly in every request header, you can centrally manage each key with Secrets Store and deploy in your gateway configuration using only a reference, rather than passing the value in plain text.

    You can now create a secret directly from your AI Gateway in the dashboard ↗ by navigating into your gateway -> Provider Keys -> Add.

    Import repo or choose template

    You can also create your secret with the newly available ai_gateway scope via wrangler ↗, the Secrets Store dashboard ↗, or the API ↗.

    Then, pass the key in the request header using its Secrets Store reference:

    curl -X POST https://gateway.ai.cloudflare.com/v1/<ACCOUNT_ID>/my-gateway/anthropic/v1/messages \
     --header 'cf-aig-authorization: ANTHROPIC_KEY_1 \
     --header 'anthropic-version: 2023-06-01' \
     --header 'Content-Type: application/json' \
     --data  '{"model": "claude-3-opus-20240229", "messages": [{"role": "user", "content": "What is Cloudflare?"}]}'

    Or, using Javascript:

    import Anthropic from '@anthropic-ai/sdk';
    

    

    const anthropic = new Anthropic({
     apiKey: "ANTHROPIC_KEY_1",
     baseURL: "https://gateway.ai.cloudflare.com/v1/<ACCOUNT_ID>/my-gateway/anthropic",
    });
    

    

    const message = await anthropic.messages.create({
     model: 'claude-3-opus-20240229',
     messages: [{role: "user", content: "What is Cloudflare?"}],
     max_tokens: 1024
    });

    For more information, check out the blog ↗!

  1. Steer Traffic by AS Number in Load Balancing Custom Rules

    Load Balancing

    You can now create more granular, network-aware Custom Rules in Cloudflare Load Balancing using the Autonomous System Number (ASN) of an incoming request.

    This allows you to steer traffic with greater precision based on the network source of a request. For example, you can route traffic from specific Internet Service Providers (ISPs) or enterprise customers to dedicated infrastructure, optimize performance, or enforce compliance by directing certain networks to preferred data centers.

    Create a Load Balancing Custom Rule using AS Num

    To get started, create a Custom Rule ↗ in your Load Balancer and select AS Num from the Field dropdown.

  1. Improvements to Monitoring Using Zone Settings

    Load Balancing

    Cloudflare Load Balancing Monitors support loading and applying settings for a specific zone to monitoring requests to origin endpoints. This feature has been migrated to new infrastructure to improve reliability, performance, and accuracy.

    All zone monitors have been tested against the new infrastructure. There should be no change to health monitoring results of currently healthy and active pools. Newly created or re-enabled pools may need validation of their monitor zone settings before being introduced to service, especially regarding correct application of mTLS.

    What you can expect:

    • More reliable application of zone settings to monitoring requests, including
      • Authenticated Origin Pulls
      • Aegis Egress IP Pools
      • Argo Smart Routing
      • HTTP/2 to Origin
    • Improved support and bug fixes for retries, redirects, and proxied origin resolution
    • Improved performance and reliability of monitoring requests within the Cloudflare network
    • Unrelated CDN or WAF configuration changes should have no risk of impact to pool health

  1. Account-level DNS analytics now available via GraphQL Analytics API

    DNS

    Authoritative DNS analytics are now available on the account level via the Cloudflare GraphQL Analytics API.

    This allows users to query DNS analytics across multiple zones in their account, by using the accounts filter.

    Here is an example to retrieve the most recent DNS queries across all zones in your account that resulted in an NXDOMAIN response over a given time frame. Please replace a30f822fcd7c401984bf85d8f2a5111c with your actual account ID.

    GraphQL example for account-level DNS analytics
    query GetLatestNXDOMAINResponses {
      viewer {
        accounts(filter: { accountTag: "a30f822fcd7c401984bf85d8f2a5111c" }) {
          dnsAnalyticsAdaptive(
            filter: {
              date_geq: "2025-06-16"
              date_leq: "2025-06-18"
              responseCode: "NXDOMAIN"
            }
            limit: 10000
            orderBy: [datetime_DESC]
          ) {
            zoneTag
            queryName
            responseCode
            queryType
            datetime
          }
        }
      }
    }
    Run in GraphQL API Explorer

    To learn more and get started, refer to the DNS Analytics documentation.

  1. Internal DNS (beta) now manageable in the Cloudflare dashboard

    DNS

    Participating beta testers can now fully configure Internal DNS directly in the Cloudflare dashboard ↗.

    Internal DNS enables customers to:

    • Map internal hostnames to private IPs for services, devices, and applications not exposed to the public Internet

    • Resolve internal DNS queries securely through Cloudflare Gateway

    • Use split-horizon DNS to return different responses based on network context

    • Consolidate internal and public DNS zones within a single management platform

    What’s new in this release:

    • Beta participants can now create and manage internal zones and views in the Cloudflare dashboard
    Internal DNS UI

    To learn more and get started, refer to the Internal DNS documentation.

  1. NSEC3 support for DNSSEC

    DNS

    Enterprise customers can now select NSEC3 as method for proof of non-existence on their zones.

    What's new:

    • NSEC3 support for live-signed zones – For both primary and secondary zones that are configured to be live-signed (also known as "on-the-fly signing"), NSEC3 can now be selected as proof of non-existence.

    • NSEC3 support for pre-signed zones – Secondary zones that are transferred to Cloudflare in a pre-signed setup now also support NSEC3 as proof of non-existence.

    For more information and how to enable NSEC3, refer to the NSEC3 documentation.

Search all changelog entries