DNS is infrastructure. It’s time to manage it that way.

Attackers aren’t always the reason for DNS failures — they can often be something much more routine. For example, the failure could result from regular domain management operations at the registrar level, as one Cloudflare 1.1.1.1 2025 DNS global outage last summer that lasted for 62 minutes. It occurred not because of a cyberattack, but a misconfiguration in their systems.  Anthony Eden, founder and CEO of DNSimple Beyond routing traffic, domains carry business value, intellectual property, and brand identity for enterprises, which is why those enterprises spend large sums on them. Those domains breathe inside the vendor dashboard — whether a registrar’s or a DNS host — and multiple stakeholders manage them manually, often leaving no record of who changed what.  When asked about the management gap, DNSimple — a developer-focused domain management automation and DNS hosting company — tells The New Stack, “Most engineers who are working at companies are already required to use tools like Terraform or Ansible to control all of their other services. So that means deploying servers and managing storage Continue reading

Dogfooding at scale: migrating cdnjs to Cloudflare’s Developer Platform

As of June 23, 2026, cdnjs, one of the Internet's busiest open-source CDNs, is running exclusively on Cloudflare’s Developer Platform. Along the way, cdnjs surfaced limits in the platform, and the platform grew to meet them.

cdnjs is a free, open-source content delivery network for JavaScript and CSS libraries. Instead of using a bundler or self-hosting jQuery, Bootstrap, or Lodash, you drop a <script> tag pointing to cdnjs.cloudflare.com and the library loads from Cloudflare's edge, instantly, anywhere in the world, with no signup, no API keys, and no rate limits. It's the infrastructure behind a significant portion of “intro to JavaScript” tutorials, CodePen demos, and Stack Overflow answers.

Community-driven, cdnjs is used on roughly 12% of all websites, a 48.3% share of the JavaScript CDN market. It serves an average of 108,000 requests per second, 9 billion per day, across more than 330 Cloudflare data centers, with a 98.6% cache hit rate. Pretty cool, Internet!

In 2011, when bundlers were exotic, npm was barely a year old, and "just drop a <script> tag" was how the web shipped JavaScript, Ryan Kirkman and Thomas Davis built cdnjs as a free, community-run mirror of every popular Continue reading

Some BGP Topics at IETF 126

The 126th meeting of the Internet Engineering Task Force (IETF) was held in Vienna at the end of July 2026. It’s a busy week with a large number of meetings and conversations. These are some notes from sessions that had BGP-related content that I found to be of interest.

Post-quantum authentication to origins is now supported

Cloudflare's Authenticated Origin Pulls and Custom Origin Trust Store now support post-quantum authentication.

Here we’ll explain how you can configure fully post-quantum secure mutually authenticated TLS connections to your origin server, dive into the engineering details of how we built it, make a shameful confession, and finally explain how this work fits into our overall post-quantum migration roadmap.

Reaching a major milestone

Our focus for the past several years has been in deploying post-quantum encryption to protect against harvest-now/decrypt-later attacks, where an attacker quietly stockpiles your encrypted data with the hope of decrypting it in the future with a quantum computer.

However, recent breakthroughs in quantum computing and cryptanalysis pulled the timelines for upgrading to post-quantum cryptography forward across industry and government and have caused us to shift our attention to deploying post-quantum authentication, to protect against attackers who will soon be able to use quantum computers to break classical credentials and carry out impersonation attacks.

In a previous post, we announced that Cloudflare is targeting 2029 for full post-quantum security, and laid out several milestones to hit along the way. We have reached the first of those milestones: our Authenticated Origin Pulls and Custom Origin Trust Store products Continue reading

DNS Topics at IETF 126

The 126th meeting of the Internet Engineering Task Force (IETF) was held in Vienna at the end of July 2026. It’s a busy week with a large number of meetings and conversations. These are some notes from sessions that had DNS topics that I found to be of interest.

HW084: Spatial Reuse in Wi-Fi

Jake Snyder joins Keith Parsons to explain the mechanics of spatial reuse in Wi-Fi. They discuss practical implementation, the trade-offs involved in increasing signal detection thresholds, and why effective RF design remains the primary method for optimizing network performance. Episode Links: Jake Snyder’s Website

The Consumable Space Data Center

I’ll admit that I’m already shaking my head when I hear someone talking about the concept of data centers in space. You’re always going to hear the same three points trying to sell it. There is unlimited solar power, no land or water constraints, and cooling in space is free because it’s cold. Sounds good in theory but physics always wins. The costs associated with the drawbacks means that what you’re being sold is entirely different from what is being delivered.

Lots of companies are jumping in to get into space. Starcloud, Axiom, Sophia Space, Google Project Suncatcher, and even the crazy million satellite promise from SpaceX want a piece of the action. However, read through the marketing and you’ll see that these companies aren’t building data centers in space. They’re really building disposable compute modules that just happen to be in space because calling them “data centers” is where you get your funding.

The hints are there if you look closely. Coverage of India’s space aspirations talk about plans to deorbit failed modules and replace them, much like Starlink satellites or mobile phones. Other consultants have talked about servicing and unit refreshes as the real Continue reading

MCP’s Auth Hardening: What the Six New OAuth SEPs Fix, and What They Still Don’t

In short, the MCP 2026-07-28 release candidate is getting attention for going stateless. The quieter story is a package of six SEPs that harden the protocol’s OAuth layer: issuer validation, credential binding, client type declaration, and cleanups around refresh tokens, scopes, and discovery. All six are worth shipping, and all six fix real failure modes. But they harden how a client authenticates to a server, and that was never the whole problem. Agent identity, per-request authorization, delegation, and audit still sit outside the spec. Which means they still sit with you.

The stateless core is soaking up most of the commentary on the new MCP release candidate, and fair enough: deleting the initialize handshake and the session ID changes how everyone deploys. But scroll past that section of the announcement and you hit six SEPs of authorization hardening that almost nobody is writing about. That’s a mistake. If you operate MCP servers that hold real credentials, this is the part of the spec that decides whether a confused client hands a token to the wrong party.

The final spec ships July 28, 2026. The release candidate was locked on May 21, and SDK maintainers are in a ten-week validation window Continue reading

Bring Your Own VLAN: Moving VMs to Kubernetes Without Changing a Single IP

For many organizations, modernizing their VMs before migrating them is not a realistic option, especially when external events trigger the migration. Mapping dependencies and refactoring network configurations before the deadline is impractical, forcing VMs to move as they are.

The mechanics of moving a VM are largely solved. Tools like Forklift handle what a vSphere admin would recognize as a cold or warm migration: copy the VMDKs off the datastore, convert the guest, and boot it as a KubeVirt VM on Kubernetes. The guest comes through with its disks, its OS, its MAC address, and the static IP still written in its network configuration.

Recreating the NSX segment the vNIC was attached to, the VLAN that defined the VM’s compliance scope, or the firewall rules that reference its address is a different story. The VM arrives in a cluster that knows nothing about any of it. Everything NSX was doing for that VM now has to be rebuilt on the Kubernetes side.

Kubernetes networking cannot solve this on its own, for two reasons. First, pod IPs are assigned dynamically from the cluster’s pod CIDR, and a KubeVirt VM attached to the pod network is treated like any other workload, meaning Continue reading

Natural disasters and government interference: examining Q2 2026’s major Internet disruption events

Like most infrastructure, the Internet's fragility is easy to overlook — as long as it's working. When it fails, its complexity comes into full view. Cloudflare is in a unique position to detect and document the moments when one of the interrelated systems the Internet depends on breaks down and connectivity suffers as a result. Each quarter, we summarize the disruptions we detect and annotate on Cloudflare Radar.

In Q2 2026, Super Typhoon Sinlaku just north of Guam caused the longest outage, while government-mandated shutdowns during exam periods in Sudan were the most frequent. Iran restored national Internet access, reconnecting its citizens to the global network after an 88-day blackout, even as damage from drone strikes continued to disrupt AWS infrastructure elsewhere in the region. Finally, a cable cut in Saint Lucia and the distribution of faulty DNSSEC signatures in Germany underscored the fragility of Internet infrastructure, but also the remarkable stability these regional and global systems maintain when operating normally.

Here we will walk through the most significant Internet disruptions we observed in the second quarter of 2026, drawing on traffic data from Cloudflare Radar to show how each unfolded and what it meant for users on the ground. Continue reading

1 2 3 … 3,890