DNS

How we halved DNS build delay and cut memory use by 85% Blog

Zone setting changes used to rebuild entire DNS zones, even ones with tens of millions of records. Here is how we built a planner that picks the smallest safe build, cutting full builds by 40%, peak memory by 85%, and halving build delay.

Cloudflare services for private origins is now generally available Blog

Public traffic to private origins, with WAF, bot management, caching, and Workers, is now available to every customer with Cloudflare One connectivity.

New DNS records experience is now the default for everyone

The new DNS records experience announced in May is now the default for all users on all plans, including Enterprise. The classic DNS records page has been retired and is no longer available in the Cloudflare dashboard. Changing a record's type When the new experience first launched, it did not support changing the type of an existing DNS record. Based on your feedback, we have since added this, s…

Advanced Nameservers use a nameserver type

Starting today, the DNS settings endpoints gradually begin to represent Advanced Nameservers with nameservers.type: "cloudflare.advanced". The rollout is expected to take seven days. Previously, the API used the "foundation_dns": true setting for this configuration. Before the rollout reaches an account, the endpoints continue to return nameservers.type: "cloudflare.standard" for Advanced Nameser…

Configure Advanced Custom Nameservers with nameserver sets (beta)

Nameserver sets are now available in beta to Enterprise accounts. A nameserver set groups two to five custom nameserver names with Cloudflare-assigned IP addresses. You can assign the set to zones in the same account. Enterprise customers using Cloudflare DNS can create Advanced Custom Nameserver sets. These sets distribute addresses across Advanced anycast network groups to improve resiliency. C…

Warnings when approaching your DNS records quota

The DNS records page in the Cloudflare dashboard now shows a warning once you have used 85% of your DNS records quota. The warning reflects the quota that applies to you. If your zone has its own quota, the warning shows that zone's usage. If your account uses an account-level DNS records quota, the warning shows your usage across all zones in the account.

Shadowed record warnings are now available for all zones

Cloudflare now displays warnings for shadowed records in all zones. A record is shadowed when a subdomain delegation gives authority for its name, or a name below it, to another set of nameservers. The record remains present, but your zone is not authoritative for it thus Cloudflare will not respond with it to matching DNS queries. These warnings help you find records that may no longer resolve f…

Internal DNS is now generally available

Internal DNS is now generally available. Internal DNS provides authoritative and recursive DNS for private networks on the same global network and control plane you already use for public DNS, Zero Trust, and application services. Why it matters Consolidate DNS operations. Public and private DNS run on one platform, with one API, one audit trail, and one place to set policy. Simplify split-horizo…

New DNS Firewall UX with more dashboard settings

The DNS Firewall page in the Cloudflare dashboard has been refreshed, bringing several settings that were previously API-only into the UI and modernizing how you view and manage your DNS Firewall clusters. What is new More settings in the dashboard: cluster options that were previously only configurable through the API — such as attack mitigation, rate limiting, negative TTL, and resolver subnet…

Account-level DNS records quota

Cloudflare now enforces DNS records quotas at the account level for Enterprise accounts. Instead of a per-zone limit, these accounts have a quota on the total number of records across all of their zones, letting you distribute records across your zones however you like — regardless of each zone's plan. Public and internal zones are counted separately, each with a default quota of 1,000,000 record…

New DNS records UX is rolling out

Starting today, everyone can opt in to a refreshed DNS records page in the Cloudflare dashboard. Over the coming weeks, the new experience will become the default for Free plan users first, followed by paid plans. What is new Better table experience: resizable and hideable columns, row pinning, advanced filters with logical operators (AND/OR), configurable pagination, and expanded input fields so…

Account-level enforce DNS-only

You can now disable Cloudflare's reverse proxy across all zones in your account simultaneously using the new enforce_dns_only setting. When enabled, Cloudflare responds to DNS queries for all proxied records with your origin IP addresses instead of Cloudflare's anycast IPs. This account-level kill switch is designed for incident response scenarios where you need to quickly route traffic directly…

Internal DNS - now in open beta

Internal DNS is now in open beta. Who can use it? Internal DNS is bundled as a part of Cloudflare Gateway and is now available to every Enterprise customer with one of the following subscriptions: Cloudflare Zero Trust Enterprise Cloudflare Gateway Enterprise To learn more and get started, refer to the Internal DNS documentation.

DNS Analytics for Customer Metadata Boundary set to EU region

DNS Analytics is now available for customers with Customer Metadata Boundary (CMB) set to EU. Query your DNS analytics data while keeping metadata stored in the EU region. This update includes: DNS Analytics — Access the same DNS analytics experience for zones in CMB=EU accounts. EU data residency — Analytics data is stored and queried from the EU region, meeting data localization requirements. D…

DNS Firewall Analytics — now in the Cloudflare dashboard

What's New Access GraphQL-powered DNS Firewall analytics directly in the Cloudflare dashboard. Explore Four Interactive Panels Query summary: Describes trends over time, segmented by dimensions. Query statistics: Describes totals, cached/uncached queries, and processing/response times. DNS queries by data center: Describes global view and the top 10 data centers. Top query statistics: Shows a bre…

Account-level DNS analytics now available via GraphQL Analytics API

Authoritative DNS analytics are now available on the account level via the Cloudflare GraphQL Analytics API. This allows users to query DNS analytics across multiple zones in their account, by using the accounts filter. Here is an example to retrieve the most recent DNS queries across all zones in your account that resulted in an NXDOMAIN response over a given time frame. Please replace a30f822fc…

Internal DNS (beta) now manageable in the Cloudflare dashboard

Participating beta testers can now fully configure Internal DNS directly in the Cloudflare dashboard ↗︎. Internal DNS enables customers to: Map internal hostnames to private IPs for services, devices, and applications not exposed to the public Internet Resolve internal DNS queries securely through Cloudflare Gateway Use split-horizon DNS to return different responses based on network context Cons…

NSEC3 support for DNSSEC

Enterprise customers can now select NSEC3 as method for proof of non-existence on their zones. What's new: NSEC3 support for live-signed zones – For both primary and secondary zones that are configured to be live-signed (also known as "on-the-fly signing"), NSEC3 can now be selected as proof of non-existence. NSEC3 support for pre-signed zones – Secondary zones that are transferred to Cloudflare…

Improved onboarding for Shopify merchants

Shopify merchants can now onboard to O2O automatically, without needing to contact support or community members. What's new: Automatic enablement – O2O is available for all mutual Cloudflare and Shopify customers. Branded record display – Merchants see a Shopify logo in DNS records, complete with helpful tooltips. Checkout protection – Workers and Snippets are blocked from running on the checkout…

Removed unused meta fields from DNS records

Cloudflare is removing five fields from the meta object of DNS records. These fields have been unused for more than a year and are no longer set on new records. This change may take up to four weeks to fully roll out. The affected fields are: the auto_added boolean the managed_by_apps boolean and corresponding apps_install_id the managed_by_argo_tunnel boolean and corresponding argo_tunnel_id An…