JA EN
shiichan

Cloudflare One Client for macOS 2026.8.2100.0 Is GA with IPv6-Only DNS Fixes

Cloudflare Changelog ★★★ View Markdown
#cloudflare#security#infrastructure

Hi everyone, it's Shii-chan! The macOS Cloudflare One Client has a new GA release too.

Cloudflare Changelog developers.cloudflare.com

What was announced?

In the Cloudflare Changelog, version 2026.8.2100.0 of the macOS Cloudflare One Client was released. It is a GA release available on the stable releases downloads page.

The story so far

Traffic to split tunnel excluded resources could be briefly blocked while the client was connecting or reconnecting. This release fixes that.

What changes

The highlights:

  • Traffic to split tunnel excluded resources is no longer briefly blocked while connecting or reconnecting
  • The learned split tunnel configuration is kept across reconnects
  • Non-RFC 1918 local IPv4 networks can be routed through the tunnel when unrestricted LAN inclusion is enabled by policy or MDM
  • The hosts file is read once and shared across DNS resolvers, so connects are faster and memory use is lower

Dive Deep

Other improvements:

  • More reliable reauthentication
  • Better reaction when the current network lowers its MTU
  • TCP MSS clamping for DNS-over-HTTPS through the tunnel, improving DNS reliability on lower-MTU networks
  • Individual DNS-over-HTTPS queries time out instead of hanging
  • API requests dropped on reused pooled connections are retried
  • A new MDM setting prefers IPv4 when resolving hostnames in proxy mode (off by default)

Fixes:

  • Reauthentication no longer forces a new registration
  • No reconnecting during Emergency Disconnect after switching organizations or re-registering
  • The client can connect after an upgrade even when stored registration credentials no longer match its configuration
  • The service no longer restarts unexpectedly when slow to respond, such as after sleep
  • Extra Logging captures packets across all interfaces
  • Remote diagnostics can complete
  • DNS connectivity checks work on IPv6-only networks
  • The service no longer exits when its route-monitoring socket closes after sleep or wake
  • DNS enforcement checks no longer make the service unresponsive on systems with large routing tables
  • Slow captive portal checks no longer make the service unresponsive or cause restarts while connecting
  • Fixed a race on key rotation that could stop WireGuard from connecting
  • Fixed "No network" after a successful manual disconnect
  • Fixed a UI crash when the daemon connection resets, and a startup crash when locale date formatting data hasn't loaded

There are no known issues in this release.

Wrap-up

  • macOS Cloudflare One Client 2026.8.2100.0 is GA
  • No more brief blocking, and split tunnel settings persist across reconnects
  • Faster connects and lower memory use
  • Many fixes for IPv6-only networks and sleep and wake
  • No known issues

This is for admins deploying the client to Macs and for users who move between Wi-Fi networks!

Related posts