DEX notifications: from reactive troubleshooting to proactive alerting
Cloudflare has added alerting capabilities to its Digital Experience Monitoring (DEX) product, part of the Cloudflare One platform. Rather than requiring administrators to constantly refresh dashboards to spot problems, the new notification rules can watch for specific conditions and trigger alerts via email, PagerDuty, or webhooks. Rules are created and managed from the standard Cloudflare dashboard notifications interface.
DEX itself collects device, application, and network performance data from WARP clients deployed across an organization's fleet. The new notifications let administrators act on that telemetry before performance issues become widespread user-facing incidents. Three distinct notification types are available, each targeting a different failure mode.
Device Connectivity Anomaly
This alert fires when there is a statistically significant change in the number of devices connecting to or disconnecting from the WARP client. Administrators can filter by data center (colo), operating system, or WARP client version. To establish what counts as "significant," Cloudflare applies a z-score calculation comparing the current five minutes of data against the previous four hours. A notification is triggered when the resulting z-score exceeds 3.5 or falls below -3.5, indicating a meaningful deviation from the expected device count.
DEX Test Latency
This notification targets application performance, alerting on significant latency spikes or drops. It is designed around two DEX test types:
- HTTP Test: Monitors Resource Fetch Time, measuring how long it takes to retrieve a resource from an application to the end user's browser.
- Traceroute Test: Monitors Round Trip Time for data packets between the device and a destination IP address, focusing on overall network performance between client and application.
The notification can be filtered by colo, platform, WARP client version, and test name.
DEX Test Low Availability
Administrators can set an SLO-based availability threshold for pre-configured DEX tests, which simulate user traffic to an application. When the percentage of successful HTTP or Traceroute requests falls below the defined threshold, the alert is sent. Filters are available for colo, platform, WARP client version, and test name.
Users need to supply their own statistical criteria for latency and availability alerts; Cloudflare provides the z-score and SLO algorithms but does not pre-select threshold values beyond the default z-score trigger point. After creation, all notification types can be edited or reviewed in the same notifications dashboard used for other Cloudflare alerts.
DEX notifications are available now for Cloudflare One customers via Dashboard > Account Home > Notifications > Add.
China Express now routes Gateway traffic through a private tunnel
Cloudflare has extended its China Express offering to cover a use case that has grown in demand: secure enterprise access to websites hosted in mainland China. Since launching China Express in January 2023 in partnership with local providers, Cloudflare has seen increased interest from global customers who want to apply consistent zero trust policies from Cloudflare Gateway — including device posture checks — even when employees or systems connect to China-hosted origins.
The problem is a familiar one for cross-border networking. Global internet traffic entering or leaving China travels over a limited set of international links that are tightly regulated, which can lead to scenic routing paths where packets transit multiple countries and networks. In practical terms, this translates into high latency and packet loss for remote employees attempting to reach services such as the AWS console in China from offices in Hong Kong, San Jose, or elsewhere.
The new China Express integration addresses this with a "reverse tunnel" model, built jointly with JD Cloud as the local partner. The routing flow is as follows:
- Traffic from a global Cloudflare Gateway customer destined for a China-hosted site is sent directly to Cloudflare's Hong Kong data center.
- At the Hong Kong point of presence, Cloudflare Gateway applies the organization's Zero Trust policies — such as DNS firewall and device posture checks — before the traffic proceeds.
- From Hong Kong, the traffic is forwarded through JD Cloud's private tunnel infrastructure into mainland China, avoiding the public internet route.
This approach is aimed at organizations that need predictable connectivity to China-hosted properties without sacrificing security controls. Administrators implement it by creating a DNS host override policy in Cloudflare Gateway, directing traffic for Chinese origins through the reverse tunnel rather than permitting it to traverse the public internet.
Cloudflare notes that the JD Cloud service is a premium offering reserved for China Network customers and requires a separate dedicated reverse tunnel contract with JD Cloud.
The benefits cited by Cloudflare are stable, predictable access to China-hosted sites; uniform enforcement of zero trust policies regardless of destination; and a simpler operational model for multinationals, e-commerce platforms, and remote employees operating across the region. Cloudflare has indicated future China Express developments may include performance improvements, additional local partnerships, and further feature work.
