# No more dig or netcat: Cloudflare Tunnel now self-checks connectivity at startup!

Yahoo, it's Shiichan! Today I want to share a small but genuinely handy update for everyone using Cloudflare Tunnel.

## What was announced?

Over on Cloudflare's Changelog, they announced that `cloudflared`, the connector for [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/), now runs connectivity pre-checks automatically at startup. This lands in [cloudflared version 2026.5.2](https://github.com/cloudflare/cloudflared/releases) and later.

## The story so far

Until now, when a tunnel would not connect, you had to install `dig` and `netcat` yourself and run those commands by hand to verify your environment. It was a bit of a chore, honestly.

## What changes

From now on, `cloudflared` checks things natively at startup for you. And when something is blocked, it even surfaces a specific remediation hint. Because it runs every time, it also catches later problems, like an overnight firewall policy change.

## Dive Deep

On every `cloudflared tunnel run` (and `cloudflared tunnel diag`), it checks three things:

- DNS resolution: whether `region1.v2.argotunnel.com` and `region2.v2.argotunnel.com` resolve to valid Cloudflare IPs.
- Transport connectivity: outbound UDP (QUIC) and TCP (HTTP/2) on port `7844`.
- Management API: outbound TCP/443 to `api.cloudflare.com` for software updates.

Results print in a CLI table with three states:

- Pass: the check succeeded.
- Warn: a non-blocking issue, for example the Management API is unreachable so automatic updates will not work, but the tunnel still comes up.
- Fail: a blocking issue, with a fix hint like `Allow outbound UDP on port 7844`.

If DNS cannot resolve, or both UDP and TCP fail on port `7844`, `cloudflared` exits early instead of looping on opaque `failed to dial` errors.

To get the new behavior, upgrade `cloudflared` to `2026.5.2` or later. For more details, see the [Connectivity pre-checks documentation](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/connectivity-prechecks/).

## Wrap-up

- Starting with `cloudflared` 2026.5.2, connectivity pre-checks run automatically at startup.
- The checks cover DNS resolution, UDP/TCP on port 7844, and TCP/443 to `api.cloudflare.com`.
- Results come as Pass / Warn / Fail, and Fail includes a remediation hint.
- No more running `dig` or `netcat` by hand, so this is a nice win for anyone operating or troubleshooting Cloudflare Tunnel!