Cloudflare has made its Private Origins capability generally available. Businesses can point a proxied DNS record at a private IP and route requests to the origin over existing Cloudflare One connectivity. The origin can stay private while Cloudflare services such as its web application firewall, caching, bot management and Workers handle requests.
The change matters if your business runs an internal API, AI agent backend, MCP server or operational tool that needs to receive requests from customers, partners or agents over the Internet. Previously, putting Cloudflare in front of such services could require exposing a public IP, opening a firewall port or running cloudflared alongside the origin. The release offers another option, but it has account and network requirements to check first.
What Cloudflare has released
Cloudflare introduced the capability in a closed beta in June. Its October 30, 2026 announcement says access is now open beyond the beta group. The key change is that a proxied A or AAAA DNS record can point to a private IP, with Cloudflare routing traffic to that origin through the customer’s existing private network connection.
The request still passes through Cloudflare’s application services. TLS termination, WAF, rules and caching continue to run on Cloudflare’s network. Existing WAF, cache and bot management configurations apply to the hostname without further changes, according to the announcement.
This is not a new way to make every private application public, nor does it remove the need to plan access and routing. It lets public traffic reach a private origin through supported Cloudflare connectivity. Cloudflare says a future private-to-private capability is in development, with a closed beta targeted for early 2027. That future work is not part of the release available today.
Why a business owner should care
Many companies rely on services that were designed for internal use, rather than direct exposure to the Internet. Yet those services may still need to exchange information with customers, partners or AI agents. Cloudflare describes internal APIs, AI agent backends, MCP servers and operational tools as examples.
Before this release, businesses wanting Cloudflare in front of these services faced specific infrastructure requirements. They could expose a public IP, open a firewall port or run cloudflared alongside the origin. The company says those requirements often meant private applications did not have the same controls as public applications.
With Private Origins, Cloudflare says services including WAF, bot management, rate limiting, caching, traffic acceleration, rewrites and Workers can be used with private origins. The announcement specifically highlights WAF, caching, bot management and Workers as available in the release. The practical point is that a service’s private location no longer automatically means giving up those Cloudflare application services.
For owners, this is a reason to review how a business-critical internal service receives outside requests. It is not, by itself, a reason to move systems or change your network. Start by identifying a real need, such as a partner integration or an API that must accept external requests, then confirm whether the existing network and Cloudflare account can support the feature.
If you are building a customer-facing portal or other web product, the network design is only one part of the work. Our website development service covers business sites, stores, portals and platforms. For a product delivered as an app, see our app development service.
What the setup requires
Private Origins is not simply a DNS setting that every account can use immediately. Cloudflare lists these requirements:
- The Private Origins entitlement must be enabled on the account. Ask your account team to turn it on.
- You need Cloudflare One connectivity using IPsec, GRE, CNI, Cloudflare Tunnel or Cloudflare Mesh.
- Unified Routing must be enabled, unless you connect over Cloudflare Tunnel. New and existing accounts can upgrade through their account team.
Once the prerequisites are in place, create a proxied A or AAAA record pointing to the origin’s private IP. For supported private IP ranges, private network routing is enabled automatically. This applies to RFC 1918 private IPv4 addresses, RFC 6598 CGNAT addresses in 100.64.0.0/10, and RFC 4193 unique local IPv6 addresses in fc00::/7. Cloudflare says the setting cannot be turned off for these ranges; attempts to disable it through the API return an error.
If the origin has a public IP but is reachable only through your private network, Cloudflare says you can enable the setting manually. For deployments using Cloudflare WAN or Cloudflare Mesh, configure a return route for Cloudflare’s source ranges: 100.64.0.0/12 for IPv4 and 2606:4700:cf1:5000::/64 for IPv6. Cloudflare Tunnel does not require Unified Routing, according to the announcement.
For automated deployments, private routing is an additional attribute on a standard DNS record. That may suit teams that manage DNS through the API, but it still depends on the entitlement and network setup above. Check the Cloudflare announcement and setup guidance for the current details and limitations before changing production records.
Limitations and checks before launch
Cloudflare says Argo Smart Routing and Dedicated CDN Egress IPs are not supported. Origin health checks require Load Balancing. These are important constraints to verify against your current design; the announcement refers readers to developer documentation for the full list of limitations.
Pay particular attention to the return route when using Cloudflare WAN or Mesh. Cloudflare reports that, during the beta, a missing route for its source range was the most common setup failure. If requests time out and nothing arrives at the origin, it recommends checking the return route first.
Do not assume that an origin is reachable merely because the DNS record exists. Confirm the account entitlement, connectivity type, routing configuration and return path with the team responsible for your network. Then test the hostname and observe whether requests arrive at the origin before relying on it for business-critical traffic.
It is also worth being precise about what the release does. It covers public traffic reaching private origins. It does not yet provide the future private-to-private traffic flow Cloudflare is working on, where users, services and AI agents on private networks reach applications on other private networks through Cloudflare’s application services.
What to do next
Use these steps to decide whether the release fits your business:
- List the services that need outside requests. Start with internal APIs, partner-facing tools, AI agent backends or operational systems. Be clear about who needs access and why.
- Ask your network team how each origin is connected. Check whether you use one of Cloudflare’s supported connectivity options and, if applicable, whether Unified Routing is enabled.
- Ask your account team about the Private Origins entitlement. Confirm it is enabled before planning a DNS change.
- Check the limitations against your setup. In particular, verify whether your design relies on Argo Smart Routing, Dedicated CDN Egress IPs or origin health checks.
- Plan and test the return route where required. For Cloudflare WAN or Mesh, confirm the specified source ranges have a return route. If requests time out without reaching the origin, check this first.
- Review the current developer documentation before deployment. Cloudflare says it covers the full setup and current limitations. Test the proxied record and application controls with the people responsible for the origin.
Private Origins gives businesses another way to put Cloudflare application services in front of services that remain on private IPs. Whether it is useful depends on the service, account entitlement and network connectivity you already operate. If you are reviewing a broader digital project, you can also use our website audit tool to identify website issues, or book a strategy call to discuss your project.
Sources
- Cloudflare services for private origins is now generally available — Cloudflare Blog, Oct 30, 2026
This article was drafted with AI from the sources above, then published only after passing 20 automated checks: every figure must appear in the sources, links must work, and nothing may be invented. Spotted an error? Tell us and we'll correct it.
Want us to do this for you?
We help businesses across 3 continents implement everything you just read — and a lot more.