Application Performance

When TLS 1.3 is enabled on a zone, visitors connecting to a hostname that serves a Keyless ECDSA certificate now negotiate TLS 1.3 while private keys stay on the customer's own key server. Keyless SSL connections using RSA certificates continue to negotiate up to TLS 1.2.

The new DNS records experience is now the default on all plans including Enterprise, and the classic DNS records page is no longer available in the dashboard. Changing an existing record's type, such as A to CNAME, is now supported via the batch DNS records endpoint.

A read-only Data Localization Suite overview in the Cloudflare dashboard consolidates Regional Services, Customer Metadata Boundary, and Geo Key Manager settings, with tabs per product and links to the page where each setting is changed.

Challenge Pages on the Cloudflare China Network now use Turnstile widgets hosted in Mainland China, so visitors there complete challenges faster without cross-border requests. The change applies automatically to China Network zones, while the global network keeps its existing Challenge Page experience.

DNS settings endpoints for zones and account defaults gradually represent Advanced Nameservers with nameservers.type: "cloudflare.advanced", replacing the foundation_dns: true configuration over a seven-day rollout. foundation_dns remains as a deprecated compatibility alias and will be removed in a future API change, and PATCH requests containing both values are rejected if they conflict.

Nameserver sets are now in beta for Enterprise accounts, grouping two to five custom nameserver names with Cloudflare-assigned IP addresses that can be assigned to zones in the same account. Setting advanced to true allocates addresses from Advanced anycast network groups, and sets are immutable reusable objects that lift the legacy limit of 5 numbered sets; legacy custom_ns sets remain supported alongside them.

Real User Monitoring in Web Analytics now breaks Largest Contentful Paint into four phases and Interaction to Next Paint into three, and splits connection time into TCP and TLS handshake. The sub-parts are shown in the dashboard and queryable through the GraphQL Analytics API via fields like lcpResourceLoadDelayP50 and inpInputDelayP50 on rumWebVitalsEventsAdaptiveGroups.

Purge requests by tag, hostname, prefix, or everything now force a Cache Reserve miss instead of marking matching content for revalidation, so the origin must redeliver content in full and Cloudflare rewrites it as a billed Class A operation; purging by URL is unchanged. A new invalidate_cache endpoint preserves the previous revalidation behavior and can serve stale content during revalidation.

A new invalidate_cache endpoint marks matching content as stale so Cloudflare revalidates with your origin on the next request and reuses the cached copy on a 304 Not Modified response. It supports the same selectors as purge and requires your origin to return an ETag or Last-Modified header and support conditional requests.

Cloudflare now displays warnings for shadowed DNS records in all zones, flagging records that remain present but no longer resolve because a subdomain delegation gave another set of nameservers authority over the name. Shadow metadata is also returned in DNS records API responses when include_shadow_metadata=true, identifying the delegating NS records and whether an A or AAAA record is glue.

The Rulesets API now supports Origin Range Requests in Cache Rules, letting Cloudflare fetch large files from origin in cache-aligned byte ranges via origin_range_requests.mode set to on, off, or default for matched traffic. Setting mode to off overrides Cloudflare's default generated range requests without changing cache eligibility.

Load Balancing now supports pool sets through the API, letting one load balancer apply different routing behavior per data center, country, or region — each pool set supplies its own candidate pools, steering policy, pool weights, and fallback pool, evaluated in array order. Pool sets support active-active distribution, location-specific failover, regional routing policies, and fixed HTTP responses for proxied traffic.

Each Cloudflare region can now make an independent health decision for a pool, so traffic can avoid an unreachable pool in one region without removing it from service elsewhere. Regional health is configured with the health_sources field on a pool; setting it to ["regional", "global"] prefers regional health and falls back to global, and pools without health_sources retain their existing behavior.

Fixed a regression where Automatic Platform Optimization stopped caching HTML requests without an explicit Accept: text/html header, serving crawlers, bots, and uptime monitors from origin with cf-cache-status: DYNAMIC. No action is needed, and a Transform Rule setting Accept: text/html as a workaround can be removed.

Web Analytics now measures client-side soft navigations, adding two new navigationType values (soft-navigation and routing-apis) alongside the existing navigate bucket. Pageview volume reported in the dashboard and GraphQL API may change, and soft navigation LCP is now measured where Chrome's Soft Navigation API is available.

Load balancing analytics now filters traffic data by pool name instead of internal pool ID, matching the names in the dropdown and fixing filtering when pools share similar names. The change affects requests over time, pool distribution, top endpoints, and latency views; the Logs view and health event filtering are unchanged.

Certificate Transparency Monitoring is now generally available on all Cloudflare plans. Alerts for certificates Cloudflare issues on your behalf are automatically filtered, and alert emails are clearer with structured certificate details and a direct link to manage CT Monitoring in the dashboard.

Load Balancing health notifications are now stateful: when a pool or endpoint recovers, the follow-up notification matches the original alert and resolves the incident automatically, with no configuration change. Recovery notifications are now sent alongside failure notifications, matching Health Checks behavior. Renaming an endpoint while an incident is open prevents the match, leaving the incident open until closed manually.

Load balancing analytics now labels fallback pool traffic with the pool name followed by "(Fallback)", shown as its own series in requests over time, a separate segment in pool distribution, and a separate card in top endpoints. Previously, fallback traffic sharing a pool name with steering-routed traffic was grouped into a single series.