Host selectors

Feature availability

Egress policies are evaluated at Layer 4 (https://www.cloudflare.com/learning/ddos/glossary/open-systems-interconnection-model-osi/) of the OSI model, where only IP addresses are available — not hostnames. The Application, Content Categories, Domain, and Host selectors need to match traffic by hostname, so Gateway uses a two-step process:

1. When Gateway receives a DNS query for a hostname that matches one of these selectors, it initially resolves the query to a temporary initial resolved IP. By default, this IP is drawn from a Cloudflare-owned public range (172.64.128.0/20 for IPv4, or 2606:4700:0cf1:4000::/64 for IPv6). You can configure a custom IPv4 range if it conflicts with your existing network.
2. When traffic arrives with this temporary destination IP, Gateway can identify which hostname the connection belongs to, apply the correct egress policy, then replace the temporary IP with the real destination IP before forwarding the traffic.

These selectors require additional configuration before they work.

Turn on Host selectors

To turn on the selectors for your account:

Dashboard

1. In the Cloudflare dashboard, go to Zero Trust > Traffic policies > Traffic settings.
2. In Policy settings, turn on Allow egress policy host selectors.

API

Use the Patch Zero Trust account configuration endpoint to update your Zero Trust configuration. For example:

PATCH /accounts/{account_id}/gateway/configuration

Prerequisites

Traffic must be on-ramped to Gateway with the following methods:

Traffic from unsupported on-ramp methods resolves using your default Gateway settings. If you use DNS locations to send DNS queries to Gateway (over IPv4, IPv6, DNS over TLS, or DNS over HTTPS), Gateway does not return the initial resolved IP and the host selectors do not apply.

Configuration changes

To configure your Zero Trust organization to use Host selectors with Egress policies:

1. Make sure you deploy the following version of the Cloudflare One Client on your users' devices:

   • Desktop: Cloudflare One Client version 2025.4.929.0 or later
   • iOS: Cloudflare One Client version 1.11 or later
   • Android and Chrome OS: Cloudflare One Client version 2.4.2 or later.

   If you need to support devices running prior versions of WARP, add and deploy the following key-value pair to your devices' WARP configuration file (mdm.xml on Windows and Linux or com.cloudflare.warp.plist on macOS):

   <array>
   	<dict>
   +		<key>doh_in_tunnel</key>
   +		<true/>
   	</dict>
   </array>
   

The Cloudflare One Client must be set to Traffic and DNS mode for traffic affected by these selectors to route correctly.

Known issues

DNS resolution location

For the Application, Content Categories, Domain, and Host selectors, Gateway captures the destination IP address during the initial DNS resolution step described above. The egress policy does not change this IP address, so the destination Gateway connects to is independent of the location of the egress data center or dedicated egress IP you select.

If the resolved destination IP and the egress IP are located in different regions, connections to destinations that enforce geo-restriction or IP-allowlisting based on the connection source may be rejected.

This can affect you if you use Domain or Host egress selectors, your users are located outside the region associated with your egress IP, and the destination applies geo-restriction or IP-based access controls.

Google Chrome restricts local network access

DNS Override policies bypass host selectors

If a domain matches a DNS Override policy, Gateway will not apply the initial resolved IP mapping for that domain. This means host-based egress selectors (Application, Content Categories, Domain, and Host) will not evaluate against traffic to the overridden domain. Traffic to these domains will use the default Cloudflare egress method.

HTTPS DNS records not supported

Host selectors do not support HTTPS DNS record types. When a domain uses HTTPS records for connection establishment, Gateway cannot map the DNS query to a hostname for egress policy evaluation. Traffic to these domains will use the default Cloudflare egress method instead of matching a host-based egress policy.

If you need to apply egress policies to a domain that uses HTTPS records, use an IP-based selector (such as Destination IP) instead.