CC BY 2.0 image by Mike Lawrence

All customers now have the ability to invite others to manage their account as Administrators. They can do this from the ‘Members’ tab in the new Account area on the Cloudflare dashboard. Invited Administrators have full control over the account except for managing members and changing billing information.

For Customers who belong to multiple accounts (previously known as organizations), the first thing they will see is an account selector. This allows easy searching and selection between accounts. Additionally, there is a zone selector for searching through zones across all accounts. Enterprise customers still have access to the same roles as before with the addition of the Administrator and Billing Roles.

As previously announced in our blog post about deprecating old TLS versions, we are migrating the dashboard from www.cloudflare.com/a to dash.cloudflare.com. The new dashboard will only support TLS versions 1.2 and greater in order for us to comply with PCI and NIST guidelines. If you are connecting to the existing dashboard with a TLS version older than 1.2, you will see a banner warning you of this.

Starting May 22, 2018, all customers visiting the dashboard at its current location, www.cloudflare.com/a will be redirected to dash.cloudflare.com.

This change is not just a UI update with some new functionality. Behind the scenes, two major changes were implemented. First, much of the dashboard has been rewritten from Backbone to React. This improves our developer velocity as the number of front-end developers building the dashboard grows. Second, We have overhauled the mobile browsing experience, so you can easily manage your zones on the go.

On the backend, we have overhauled our data model for account and user management. Whereas before accounts, users and the resources they owned were very tightly coupled, now they are distinct, decoupled objects. This major change is what enabled us to expand multi-user access to all of our customers. Segregating users from accounts also allows us to clean up our architecture for our distributed development teams. The systems that power our products can now be explicit in what they need access to (users vs accounts), and we can limit their access to that data appropriately.

This is just the first step in bringing a better user management story to all customers. We have many improvements planned for how customers authenticate, manage access and permissions, and organize their zones in Cloudflare. If you have feedback on the new experience or what you’d like to see us build next, visit the dashboard section of the Cloudflare Community, and let us know!

It's been a year since we launched Virtual DNS, and the service has expanded a lot since then. Virtual DNS now answers 7 billion DNS queries a day, 4.6 billion of which are served from our cache, saving our Virtual DNS customers a collective 65% of their bandwidth. Beyond the bandwidth savings, Virtual DNS also protected its customers from a large vulnerability in BIND when it was discovered in August.

Virtual DNS is different from CloudFlare’s core authoritative DNS service, which comes included in CloudFlare’s standard plans. In authoritative DNS, CloudFlare hosts DNS records for a zone on its own infrastructure. In Virtual DNS, the customer hosts all of the DNS records for all of their zones, and CloudFlare serves as a front end proxy to them.

The new Virtual DNS dashboard makes it fast and easy to update Virtual DNS settings, and the changes are just as quickly propagated worldwide.

Alongside the dashboard, we've also released a new API for managing Virtual DNS. You can now configure every aspect of Virtual DNS programmatically. This is how easy it is to spin up a new Virtual DNS instance -- it’s just one command:

$ curl -X POST "https://api.cloudflare.com/client/v4/user/virtual_dns" \
-H "X-Auth-Email: user@example.com" \
-H "X-Auth-Key: XXX" \
-H "Content-Type: application/json" \
--data '{"name":"My Awesome Virtual DNS cluster","origin_ips":["1.1.1.1","2.2.2.2"],"minimum_cache_ttl":60,"maximum_cache_ttl":900,"deprecate_any_request":true}'

Virtual DNS now supports Multi-User access control. You can now invite your team members to manage your Virtual DNS instance together. Multi-User comes with advanced security features such as the ability to require the use of two-factor authentication across your team. If you are a Virtual DNS user and have not yet enabled Multi-User, reach out to to your sales rep to get upgraded.

Caching has always been a tradeoff between serving the most up-to-date data and having speedy responses, but starting today, we are giving Virtual DNS customers total control of how long we cache their DNS answers for.

This means that a DNS provider can reduce the amount of time we cache their answers to optimize for up-to-date data, but if any of their servers start to have problems, they can immediately increase the caching time to lessen the load on their origin DNS servers.

In October 2015, CloudFlare stopped answering the ANY query, a special query type in DNS meant to return every DNS record in a zone. It’s mostly used to launch giant DDoS attacks and hardly ever used for legitimate traffic. If DNS providers behind Virtual DNS also want to stop serving large answers for ANY, they can now enable ANY deprecation in one click or API call, which several of our Virtual DNS customers have already done.

If you are a current customer of Virtual DNS, someone on your account team will be reaching out today to get you started with the dashboard and new features. If you are a DNS provider or registry and are not yet a Virtual DNS customer and would like to be, get in touch.

Your web developer needs to update your website’s logo and make sure it’s live immediately, but doesn’t need access to your SSL keys. Your sysadmin manages your DNS, but doesn’t need to see your visitor traffic. Your marketing team needs to see traffic, but shouldn’t have access to your WAF.

Today CloudFlare is introducing new Multi-User functionality so that many members of a team can work together to manage one CloudFlare account, each with different levels of access.

CloudFlare Multi-User accounts are hierarchical, with the root privileges given to the account’s Super Administrator. The Super Administrator can add or delete users in the organization, change the permissions given to each user, and see and edit all CloudFlare settings. If there is more than one Super Administrator, the Super Administrators can remove each other, which is good practice when an employee leaves the company or switches jobs.

When a user joins a multi-user organization on CloudFlare, they can only see and access the settings that a Super Admin has delegated to them. For example, a user added to the organization as a DNS Administrator would only be able to access the DNS app:

A user added to the organization as an Analytics Administrator would only be able to access analytics, but not see or change other settings:

Roles can be mixed and matched so that a team can customize the permissions for their needs.

Here is what a user sees that has both DNS and Analytics roles:

Passwords are known to be weak, (try yours here: how quickly does it break?) but stronger methods of authentication such as two-factor authentication (2FA) typically don’t work when multiple people need to share access to a single account.

Over the past year, the world has witnessed many prominent corporate and government accounts compromised as a result of not using two-factor authentication. We’ve supported two-factor authentication for years, and we encourage everyone to turn it on. With Multi-User, any size organization can use 2FA for account security.

Beyond 2FA, Multi-User also provides each user with their own API key so that independent keys can easily be revoked and reissued.

Multi-User is an Enterprise-only feature and is already in use by large multinational organizations and governments. Starting today, Multi-User is available for all CloudFlare Enterprise customers. If you are an Enterprise customer who would like to have Multi-User enabled, contact your account manager. Not yet a customer? Contact our sales team.

This new functionality is only possible on the new CloudFlare dashboard that we are in the process of rolling out to all users this week