Changelog

Jun 29, 2026

A new GA release for the macOS Cloudflare One Client is now available on the stable releases downloads page.

This release introduces multiple features from our previous beta release into stable release, including:

• The client now applies DNS search suffixes configured in your device profile / network policy. Administrators can push a list of DNS search domains that the client appends to single-label queries, alongside any system-configured suffixes. See DNS search suffixes for details.
• Upgraded security of device registration to be hardware-backed. Registration tokens can now be generated in the Secure Enclave whenever available to provide stronger protection against device impersonation. See Hardware-backed registration for details.
• Added a local-file signal source for Emergency Disconnect. In addition to the existing HTTPS polling mechanism, administrators can now configure WARP to monitor for a file on disk; the presence of the file triggers an emergency disconnect even if both Cloudflare and your own infrastructure are unreachable. Either signal being asserted triggers disconnect; both must be cleared for normal operation to resume.
• Added new warp-cli debug commands for interactive connection diagnosis. See Extra debug logging for details.
• The local DNS proxy now supports DNSSEC passthrough. DNSSEC-signed responses are forwarded to the application intact (including DO/AD bits and RRSIG records), so applications that validate DNSSEC locally — including resolvers and the dig/drill tooling — work correctly through the client.
• Added a new MDM format for organization-wide settings, including a cleaner way to configure the compliance environment (e.g. FedRAMP). The previous per-configuration approach still works, but the new format is now recommended. See the updated Cloudflare One MDM documentation for details.
• Added support for dashboard-managed client version deployments. Administrators can now upgrade or downgrade the client version on enrolled devices directly from the Zero Trust dashboard. See Client version assignments for details.

Additional Changes and improvements

• Client Certificate device-posture checks now support template variables (e.g. ${serial_number}, ${device_uuid}) in the Subject Alternative Name field. Previously only the Common Name field accepted variables, which broke posture rules that pinned identity to a SAN entry.
• Improved accessibility by using high contrast colors and more defined color boundaries when high contrast is enabled in the macOS Display settings.
• Path MTU Discovery (PMTUD) is now enabled by default.
• Fixed the in-client captive-portal browser rendering a blank "Success" page on some airline Wi-Fi networks. The browser now more consistently loads the airline's real portal page so users can complete sign-in from inside the client instead of having to open a separate browser.
• Fixed an issue in proxy mode where hostnames containing underscores (e.g. ai_app.com) were rejected, breaking apps that depend on such hostnames (notably ChatGPT sandbox apps). The local proxy now accepts underscore-containing hostnames in CONNECT requests.
• Fixed an issue where DNS queries would fail after the connection was idle, requiring users to retry.
• Users can now register with team names in any case format without errors.
• New UI fixes
  • Fixed an issue where users with invalid MDM configurations were returned to the onboarding screen after successful authentication.
  • Added a re-auth button and banner to the home screen so users don't miss it when their session expires.
  • Added clear error messaging when the Cloudflare certificate needs to be installed.
  • Brought back support for pausing the tunnel when connected to user-specified Wi-Fi networks for consumer users.
  • New client UI now surfaces Split tunnel configuration and Local Domain Fallback configuration.
  • Added ability to configure proxy mode for consumer users.
  • Added back the option to quit for consumer users.

Known issues

• Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed.