Introducing simple and secure egress policies by hostname in Cloudflare’s SASE platform

Cloudflare announced an open beta enabling its SASE Gateway to enforce egress policies by hostname, domain, content category, and application, simplifying control over source IP and egress location for external services. Because egress decisions occur at L4, the team built a DNS-based “initial resolved IP” mechanism that returns synthetic IPs from CGNAT ranges to tag flows and then rewrites to the real destination, enabling scalable, dynamic hostname mapping (including wildcards). The feature currently requires DNS and network traffic to land on the same server via the same tunnel, with plans to expand on-ramps and extend hostname-based rulesets across the platform.