Application Performance

Internal DNS is now generally available, providing authoritative and recursive DNS for private networks through Cloudflare's global network and control plane, with support for split-horizon DNS, Zero Trust resolver policies, and a unified API for public and private DNS operations.

Account-wide Web Analytics dashboards now load reliably for accounts with up to 1,000 sites, fixing timeouts and interface errors that previously affected larger accounts. Accounts with over 1,000 sites now see a clear error with instructions to filter by site.

Cloudflare's cache now honors the Vary response header directly in Cache Rules, allowing the same URL to hold multiple cached versions matched by request headers. Origin decides which headers matter, and cache key calculation follows RFC 9111.

Cloudflare AMP and SXG support has reached end of life. The Zone API will throw errors for AMP/SXG configuration, and rulesets with SXG config must remove it to save successfully.

Cloudflare Fonts now forwards /cf-fonts requests to your origin server when it encounters invalid paths or unexpected runtime errors, instead of returning 4xx or 5xx responses directly. This update also adds additional input validation to enhance security.

Cloudflare now accepts ML-DSA (FIPS 204) post-quantum certificates for Authenticated Origin Pulls and Custom Origin Trust Store, establishing end-to-end post-quantum authentication on the Cloudflare-to-origin connection. Combined with existing X25519MLKEM768 key agreement for a fully post-quantum origin handshake.

Cloudflare now enforces DNS records quotas at the account level for Enterprise accounts. Instead of a per-zone limit, these accounts have a quota on the total number of records across all of their zones, letting you distribute records across your zones however you like —…

Cloudflare now returns a BYPASS cache status whenever a response is not cacheable, instead of the previous mix of BYPASS and MISS that depended on why Cloudflare chose not to cache the response.

Starting today, everyone can opt in to a refreshed DNS records page in the Cloudflare dashboard. Over the coming weeks, the new experience will become the default for Free plan users first, followed by paid plans.

The /cdn-cgi/rum beacon endpoint now returns 405 Method Not Allowed for non-POST requests instead of 404 Not Found. The response includes an Allow: POST, OPTIONS header per RFC 9110 §15.5.6.

Cloudflare's cache now runs on a new proxy built on Pingora, the Rust-based framework that already serves a significant portion of Cloudflare's network traffic. The new proxy is faster, more memory-safe, and designed to evolve our cache…

Shared dictionaries (RFC 9842) let an origin compress a response against a previous version of the same resource that the browser already has…

Cloudflare Web Analytics now supports Navigation Type reporting and filtering.

You can now disable Cloudflare's reverse proxy across all zones in your account simultaneously using the new enforce_dns_only setting. When enabled, Cloudflare responds to DNS queries for all proxied records with your origin IP addresses instead of Cloudflare's anycast IPs.…

Cache Response Rules now work with Version Management. You can version response-phase cache settings and promote them through environments, just like Cache Rules and other supported configurations.

You can now achieve higher cache HIT rates and reduce origin load for origins hosted on public cloud providers with Smart Tiered Cache. By setting a cloud region hint for your origin, Cloudflare…

You can now manage mutual TLS (mTLS) and Bring Your Own Certificate Authority (BYO CA) configurations directly from the Cloudflare dashboard — no API required.

Internal DNS is now in open beta.

You can now control how Cloudflare handles origin responses without changing your origin. Cache Response Rules let you modify Cache-Control directives, manage cache tags, and strip headers like Set-Cookie from origin responses before they reach Cloudflare's cache. Whether…