8 August 2026

Cloudflare WARP: Fallback Domains and Split Tunnels Solve Different Problems

DNS resolution and packet routing are related, but a WARP configuration often needs you to reason about them separately.

A useful distinction when troubleshooting WARP is:

Where should this name be resolved?

is not the same question as:

Where should traffic to the resulting address be routed?

Fallback domains are primarily about DNS resolution.

Split tunnels are about traffic routing.

Conceptually:

Application asks for a hostname
            ↓
        DNS decision
            ↓
    Which resolver handles it?
            ↓
        IP address
            ↓
      Routing decision
            ↓
Does WARP carry the traffic?

It is possible to get the DNS part right and the routing part wrong — or vice versa.

That is why I try to troubleshoot them as two related control planes rather than one setting.

A useful diagnostic sequence is:

1. Which hostname is being requested?
2. Which DNS resolver answered?
3. What address was returned?
4. Is that destination included/excluded by split-tunnel policy?
5. Which path did the connection actually take?

That separation makes a surprising number of WARP problems easier to reason about.