DNS filtering without the backhaul
Cloudflare for Teams, announced earlier this week, pairs two products: Cloudflare Access for securing internal applications and Cloudflare Gateway for protecting users from Internet-borne threats. Today Cloudflare Gateway is moving out of beta with the addition of secure DNS filtering, available now at dash.teams.cloudflare.com; initial setup takes less than five minutes.
The new filtering layer is built on 1.1.1.1, Cloudflare's public DNS resolver, and checks every query against threat intelligence and customer-defined policies before a response is returned. Because Cloudflare's network spans data centers in more than 200 cities and every service runs in every location, DNS queries travel to the nearest edge instead of being hauled back to headquarters — an architectural difference that addresses the core problem with legacy security models.
Why the old model broke
Legacy network security was designed for a world where employees worked in branch offices and business-critical applications lived inside the corporate data center. In that model, all Internet-bound traffic was routed through a centralized hardware firewall that performed SSL inspection and DNS filtering in one location. That worked when most traffic stayed inside the corporate network. It stopped working when SaaS became the norm: average SaaS spending per company has grown more than 1615% in the last 10 years, multiplying the volume of Internet-bound requests from distributed offices and remote workers.
The symptoms of that breakdown are familiar. In beta testing with Cloudflare customers, one organization with more than 50 branch offices sent all DNS traffic through a single location. An employee in India making a request to google.com had that DNS query travel all the way to the company's New York headquarters. The conventional fix — MPLS links connecting branch offices to a central site — is expensive and slow to provision, which is why many businesses either spend millions on legacy connectivity or accept sluggish performance that drags down productivity.
Latency isn't the only casualty of the centralized model. Modern threats move faster than static hardware rules can react: approximately 84% of phishing sites exist for less than 24 hours, so appliances relying on manually updated policies leave employees exposed to attacks that didn't exist when the rules were written.
Where DNS filtering stops an attack
DNS is a particularly effective chokepoint for security. More than 90% of malware uses DNS to perform command-and-control and data exfiltration. A typical infection chain illustrates why:
- A user receives a phishing email impersonating a colleague, with a link to a fake file-sharing site.
- Clicking the link delivers an exploit and installs malware.
- The malware queries DNS to locate its command-and-control server.
- The server then instructs the malware to steal data, reboot machines, or participate in DDoS attacks.
DNS filtering can interrupt this attack twice: first when the browser resolves the phishing domain, and again when the malware attempts to resolve the command-and-control server's address. In both cases, the query matches a known threat and is blocked before any content loads. The Global Cyber Alliance estimates that companies could have prevented losses exceeding $200B with this sort of protection.
How Gateway's filtering is different
The standard 1.1.1.1 resolver answers every query without judgment. Gateway inserts a single extra step: before responding, it checks the queried name against Cloudflare's threat intelligence and the customer's configured policies. If the name matches a known threat or a blocked category, the query stops there — no content reaches the user, and no code gets a chance to execute.
That difference — allowing all queries versus evaluating each one — is the whole product. Gateway doesn't require organizations to rip out their existing network architecture; businesses of any size can start sending their DNS traffic to Cloudflare's edge and get policy enforcement without additional hardware or WAN links.
Encrypted DNS from the start
Gateway supports DNS over HTTPS immediately, with DNS over TLS planned for the future. Firefox users can begin sending encrypted queries to Gateway today, and any DNS over HTTPS client that lets you specify a custom hostname will work. The flow is straightforward: the client encrypts the request and sends it to Cloudflare's closest data center, where it is decrypted, checked against Gateway policies, and returned encrypted to the client. This approach prevents ISPs from snooping on DNS queries while still allowing malicious domains to be filtered.
Pricing and availability
Gateway includes a free tier intended for small businesses, teams, and households that can't justify enterprise security spending. Paid tiers add features such as longer analytics retention, more granular content and security categories, individual DNS query logs, and logpush to cloud storage. Customers can sign up with an existing Cloudflare account, and the product page at teams.cloudflare.com/gateway documents the full feature set.
Algolia, a Cloudflare Gateway beta customer, used the service to maintain visibility across its corporate network during a year of rapid growth. Adam Surak, Algolia's Director of Infrastructure & Security, said Gateway provided that visibility "without slowing things down for our employees."
Starting with Gateway
Existing Cloudflare users can begin immediately from the Teams dashboard. The onboarding flow guides you through configuring a router or device to direct DNS queries to Gateway, and helps you establish a location — typically a physical site such as an office, retail store, data center, or home.
Once onboarding is complete, the next step is creating a policy. Policies block access to malicious websites for anyone using the internet from the location you set up.
Policies can be built from predefined categories, or you can manually block specific domains through Gateway.
After DNS queries are routed to Gateway, the Teams dashboard displays analytics to help you spot anomalies in network activity.
Roadmap
Cloudflare's broader mission is a better Internet, already pursued through website protection and the WARP client for device security. Cloudflare Access secured internal applications, and Gateway extends that reach to everyday internet users via secure DNS filtering. The current offering is an early look at a larger platform, with further capabilities planned.
