Cloudflare One

Request Gateway DNS64 through DNS locations and EDNS

You can now request DNS64 through Cloudflare Gateway DNS location settings or Extension Mechanisms for DNS (EDNS) options.

Unified dashboard navigation for Zero Trust

The Cloudflare dashboard now combines Zero Trust and main dashboard navigation. You can move between Cloudflare products from the same navigation.

Cloudflare Organizations is generally available

Cloudflare Organizations is now generally available for Enterprise customers and MSSP/Distributor partners.

BGP over IPsec and GRE tunnels generally available

BGP peering over IPsec and GRE tunnels is generally available for Cloudflare WAN and Magic Transit. You can use it for production workloads.

New strict service token authentication setting for Access

The strict service token authentication setting applies consistent behavior to requests made with service tokens. When the setting is on for a Zero Trust organization, Access handles requests with service token headers as follows:

Simplified permissions for tagging targets with Access for Infrastructure

You can now tag targets using only the Zero Trust Write API token permission. Previously, tagging targets through the API required both Zero Trust Write and Tag Write permissions on the API token.

Role-based access control for Browser Isolation policies

Isolation policies support role-based access control (RBAC). Because isolation policies are Gateway HTTP policies with the Isolate action, Gateway's account-level and resource-scoped roles apply to them directly.

Identify Mesh, Workers VPC, and Cloudflare Tunnel replicas in network logs

You can now tell a person on a laptop apart from a Mesh node or an AI agent running on Workers, without matching on connector email addresses or Mesh IP ranges — and see exactly which Cloudflare Tunnel and cloudflared replica received each session.

MCP server portals are now generally available

to all Cloudflare customers. A portal gives users one endpoint for approved Model Context Protocol (MCP) servers. Cloudflare Access logs tool, prompt, and resource activity.

Add Mesh participants with guided onboarding

Cloudflare Mesh now makes it faster to add and manage participants from the dashboard. Select Add participant from Networking > Mesh to deploy a Mesh node or find the information needed to connect a client device.

Traffic Destination selector in Gateway policies

Gateway HTTP and Network policies now include a Traffic Destination selector that identifies how traffic exits Cloudflare.

Private MCP server support for MCP server portals

MCP server portals can now connect to MCP servers available only on your private network. The portal uses Cloudflare Gateway to reach private hostnames and IP addresses without exposing the MCP server to the public Internet.

Unified Routing generally available

Unified Routing is generally available for Cloudflare WAN and Magic Transit.

Access for Infrastructure now supports tagged targets and tag-based target criteria

Access for Infrastructure now integrates with Resource Tagging. You can attach key-value tags to infrastructure targets and use them in access policies.

Improved iOS tap-to-type experience for Browser Isolation

Browser Isolation has improved the tap-to-type experience for users on iOS devices.

Define custom applications for breakout and prioritized traffic from the Cloudflare One Appliance dashboard

You can now define custom applications for breakout and prioritized traffic on the Cloudflare One Appliance directly from the dashboard, without calling the API.

Configure DHCP options from the dashboard on Cloudflare One Appliance

You can now configure custom DHCP options directly from the dashboard when the Cloudflare One Appliance is acting as the DHCP server for a LAN.

Create multiple Cloudflare Tunnel and Cloudflare Mesh routes at once

You can now create multiple Cloudflare Tunnel and Cloudflare Mesh routes from the Routes page in a single action, instead of submitting one route at a time.

MCP server portals support MCP 2026-07-28 specification

MCP server portals support the stateless MCP 2026-07-28 specification for client and upstream server connections.

Download the Cloudflare One Virtual Appliance for your hypervisor from the dashboard

When you register a Cloudflare One Virtual Appliance, you can now select your hypervisor and download the appliance directly from the dashboard — no need to look up asset URLs.