Application Performance

Cloudflare now displays warnings for shadowed DNS records in all zones, flagging records that remain present but no longer resolve because a subdomain delegation gave another set of nameservers authority over the name. Shadow metadata is also returned in DNS records API responses when include_shadow_metadata=true, identifying the delegating NS records and whether an A or AAAA record is glue.

The Rulesets API now supports Origin Range Requests in Cache Rules, letting Cloudflare fetch large files from origin in cache-aligned byte ranges via origin_range_requests.mode set to on, off, or default for matched traffic. Setting mode to off overrides Cloudflare's default generated range requests without changing cache eligibility.

Load Balancing now supports pool sets through the API, letting one load balancer apply different routing behavior per data center, country, or region — each pool set supplies its own candidate pools, steering policy, pool weights, and fallback pool, evaluated in array order. Pool sets support active-active distribution, location-specific failover, regional routing policies, and fixed HTTP responses for proxied traffic.

Fixed a regression where Automatic Platform Optimization stopped caching HTML requests without an explicit Accept: text/html header, serving crawlers, bots, and uptime monitors from origin with cf-cache-status: DYNAMIC. No action is needed, and a Transform Rule setting Accept: text/html as a workaround can be removed.

Web Analytics now measures client-side soft navigations, adding two new navigationType values (soft-navigation and routing-apis) alongside the existing navigate bucket. Pageview volume reported in the dashboard and GraphQL API may change, and soft navigation LCP is now measured where Chrome's Soft Navigation API is available.

Load balancing analytics now filters traffic data by pool name instead of internal pool ID, matching the names in the dropdown and fixing filtering when pools share similar names. The change affects requests over time, pool distribution, top endpoints, and latency views; the Logs view and health event filtering are unchanged.

Certificate Transparency Monitoring is now generally available on all Cloudflare plans. Alerts for certificates Cloudflare issues on your behalf are automatically filtered, and alert emails are clearer with structured certificate details and a direct link to manage CT Monitoring in the dashboard.

Load Balancing health notifications are now stateful: when a pool or endpoint recovers, the follow-up notification matches the original alert and resolves the incident automatically, with no configuration change. Recovery notifications are now sent alongside failure notifications, matching Health Checks behavior. Renaming an endpoint while an incident is open prevents the match, leaving the incident open until closed manually.

Load balancing analytics now labels fallback pool traffic with the pool name followed by "(Fallback)", shown as its own series in requests over time, a separate segment in pool distribution, and a separate card in top endpoints. Previously, fallback traffic sharing a pool name with steering-routed traffic was grouped into a single series.

Cloudflare now predicts the preferred TLS 1.3 key agreement algorithm for each origin and sends its key share in the first ClientHello, avoiding an extra network round trip. Automatic key exchange is on for all existing zones and on by default for new zones, with a preference for the X25519MLKEM768 post-quantum hybrid when supported.

Internal DNS is now generally available, providing authoritative and recursive DNS for private networks through Cloudflare's global network and control plane, with support for split-horizon DNS, Zero Trust resolver policies, and a unified API for public and private DNS operations.

Account-wide Web Analytics dashboards now load reliably for accounts with up to 1,000 sites, fixing timeouts and interface errors that previously affected larger accounts. Accounts with over 1,000 sites now see a clear error with instructions to filter by site.

Cloudflare's cache now honors the Vary response header directly in Cache Rules, allowing the same URL to hold multiple cached versions matched by request headers. Origin decides which headers matter, and cache key calculation follows RFC 9111.

Cloudflare AMP and SXG support has reached end of life. The Zone API will throw errors for AMP/SXG configuration, and rulesets with SXG config must remove it to save successfully.

Cloudflare Fonts now forwards /cf-fonts requests to your origin server when it encounters invalid paths or unexpected runtime errors, instead of returning 4xx or 5xx responses directly. This update also adds additional input validation to enhance security.

Cloudflare now accepts ML-DSA (FIPS 204) post-quantum certificates for Authenticated Origin Pulls and Custom Origin Trust Store, establishing end-to-end post-quantum authentication on the Cloudflare-to-origin connection. Combined with existing X25519MLKEM768 key agreement for a fully post-quantum origin handshake.

Cloudflare now enforces DNS records quotas at the account level for Enterprise accounts. Instead of a per-zone limit, these accounts have a quota on the total number of records across all of their zones, letting you distribute records across your zones however you like —…

Cloudflare now returns a BYPASS cache status whenever a response is not cacheable, instead of the previous mix of BYPASS and MISS that depended on why Cloudflare chose not to cache the response.

Starting today, everyone can opt in to a refreshed DNS records page in the Cloudflare dashboard. Over the coming weeks, the new experience will become the default for Free plan users first, followed by paid plans.