Global policies
Cloudflare Zero Trust applies a set of global policies to all accounts.
DNS policies
| Criteria |
Value |
Action |
Description |
| Hostname |
*.nel.cloudflare.com |
allow |
Allows SNI domains for WARP registration. |
| Hostname |
*.cloudflareclient.com |
allow |
Allows Zero Trust client. |
| Hostname |
*.cloudflare-gateway.com |
allow |
Allows Gateway proxy with PAC files. |
| Hostname |
dash.teams.cloudflare.com, help.teams.cloudflare.com, blocked.teams.cloudflare.com, api.cloudflare.com, cloudflarestatus.com, www.cloudflarestatus.com, and one.dash.cloudflare.com |
allow |
Allows Cloudflare Zero Trust services. |
| Hostname |
*.cloudflareaccess.com |
allow |
Allows Cloudflare Access applications. |
Network proxy policies
| Criteria |
Value |
Action |
Description |
| Hostname |
*.cloudflareaccess.com |
allow |
Allows Cloudflare Access applications. |
| Hostname |
help.teams.cloudflare.com |
allow |
Used by the WARP client to check if Gateway is on by inspecting the certificate and checking if it is properly installed on the client device. |
| Content Category |
Child Abuse |
block |
Blocks child abuse materials. |
HTTP inspection policies
| Criteria |
Value |
Action |
Description |
| Hostname |
*.cloudflareclient.com |
bypass |
Ensures users cannot accidentally block themselves from making account changes. |
| Hostname |
*.cloudflarestatus.com |
bypass |
Bypasses cloudflarestatus.com so users can reach the status page in case of a Gateway outage. |
| Hostname |
*.cloudflare-gateway.com |
bypass |
Ensures requests to the cloudflare-gateway.com DNS endpoint will not be inspected. |
| Hostname |
*.nel.cloudflare.com |
bypass |
Bypasses *.nel.cloudflarestatus.com for Cloudflare’s network error logging feature. |
| Hostname |
api.cloudflare.com |
bypass |
Bypasses Cloudflare’s API endpoint. |
| Hostname |
dash.teams.cloudflare.com |
bypass |
Prevents users from being locked out of the Zero Trust dashboard. |
| Hostname |
*.dash.cloudflare.com |
bypass |
Bypasses the Cloudflare dashboard and subdomains. |
| Hostname |
blocked.teams.cloudflare.com |
bypass |
Prevents an infinite loop on the Gateway block page. |
| Hostname |
developers.cloudflare.com and help.cloudflarebrowser.com |
noisolate |
Prevents isolation of Cloudflare developer docs and help pages to help users troubleshoot configuration issues. |
| Hostname |
*.assets.browser.run |
bypass |
Required for Remote Browser Isolation (RBI). |
| Hostname |
*.edge.browser.run and *.cloudflarebrowser.com |
bypass |
Required for RBI. |
| Hostname |
*.edge.browser.run and *.cloudflarebrowser.com |
isolate |
Required for RBI. |
| Hostname |
speed.cloudflare.com |
noscan |
Allows files transferred by the Cloudflare speed test. |
| Request Header |
Accept: text/html |
noisolate |
Ensures only browsers will be isolated. Browsers issue an Accept: HTTP header that begins with text/html. |
| Application |
Online Certificate Status Protocol |
bypass |
Enables OCSP stapling. |