Introducing simple and secure egress policies by hostname in Cloudflare’s SASE platform
Jul 7, 2025Ankur Aggarwal, Sharon Goldberg, João Paiva, Alyssa Wang
Summary
This post introduces egress policies by hostname, domain, content category, and application within Cloudflare's SASE platform. Previously, egress policies were limited to user groups and destination IP addresses, making it difficult to manage access to external services with dynamic IP addresses. The new feature leverages Cloudflare's DNS resolver and a 'synthetic IP' mechanism to associate DNS queries with network connections, enabling L4 egress policy evaluation based on L7 information like hostnames. This significantly simplifies policy management for organizations and enhances security by providing more granular control over outbound traffic.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack