导航|地址|刷新
Content Delivery Network (CDN) Reference…

Skip to contentDocumentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/reference-architecture/llms.txt
Use this file to discover all available pages before exploring further.



DocsDirectoryAPISDKsChangelog

Search

Log in






Reference Architecture

/




Overview

How to use

Find by solution


Reference Architectures


Cloudflare SASE with CrowdStrike

Cloudflare SASE with Microsoft

Cloudflare SASE with SentinelOne

Content Delivery Network (CDN)

Load Balancing

Magic Transit

Multi-Vendor Architecture

Secure Access Service Edge (SASE)

Security Architecture

AI Security for Apps

Email Security Deployments






Reference Architecture Diagrams



Artificial Intelligence (AI)


AI Vibe Coding Platform

Automatic captioning for video uploads

Composable AI architecture

Content-based asset creation

Enterprise AI Vibe Coding Platform

Ingesting BigQuery Data into Workers AI

Multi-vendor AI observability and control

Retrieval Augmented Generation (RAG)

Enterprise AI agent workspace






Bots


Bot management






Content Delivery


Optimizing image delivery

Distributed web performance






Internet of Things (IoT)


Connected transportation systems






Network


BYOIP to Cloudflare

Device roaming with geolocated IPs

Protect data center networks

Protect hybrid cloud networks

Protect ISP and telecommunications networks from DDoS attacks

Protect public networks






Secure Access Service Edge (SASE)


Access to private apps without having to deploy client agents

Cloudflare One Appliance deployment

DNS filtering solution for Internet service providers

Protective DNS for governments

Secure access to SaaS applications

Self-hosted VoIP for hybrid users

Zero Trust and Virtual Desktop Infrastructure

ZTNA with external authorization






Security


FIPS 140 level 3 compliance with Cloudflare Application Services

Securing data at rest

Securing data in transit

Securing data in use






Serverless


A/B-testing using Workers

Fullstack applications

Programmable Platforms

Serverless ETL pipelines

Serverless global APIs

Serverless image content management






Storage


Control and data plane architectural pattern for Durable Objects

Egress-free object storage in multi-cloud setups

Event notifications for storage

On-demand Object Storage Data Migration

Storing user generated content










Design Guides


Cloudflare's benefits for SaaS providers

Leveraging Cloudflare for your SaaS applications

Zero Trust for SaaS applications

Designing ZTNA access policies

Network-focused VPN migration

Secure application delivery

Securing guest wireless networks

Streamlined WAF deployment across zones and applications

Zero trust architecture for startups






Implementation Guides



Zero Trust


Secure your Internet traffic and SaaS apps ↗

Replace your VPN ↗

Secure your email with Email security ↗

Deploy clientless access ↗

Holistic AI Security with Cloudflare One ↗






Application Security


Use mTLS with Cloudflare protected resources ↗










Agent resources


Agent setup ↗

Cloudflare Skills ↗

Code Mode MCP Server ↗

Domain-specific MCP Servers ↗MCP

Reference Architecture llms.txt ↗

Reference Architecture llms-full.txt ↗

Cloudflare Docs llms.txt ↗

Cloudflare Docs llms-full.txt ↗













Home

/Reference Architecture

/Reference Architectures

/Content Delivery Network (CDN)



Content Delivery Network (CDN) Reference Architecture


Last updated Apr 16, 2026|Copy as Markdown|View as Markdown|Agent setup

OverviewIntroduction Who is this document for and what will you learn?Traditional challenges deploying web applicationsHow a CDN tackles web application challenges Impacts Routing requests to CDN nodesIntroducing the Cloudflare CDNCloudflare CDN architecture and design Tiered Cache Traffic flow: Tiered Cache, Smart Tiered Cache topology Regional Tiered Cache Argo Smart Routing Cache Reserve Traffic flow: Cache Reserve topology China Network & Global Acceleration for clients in ChinaSummary





Introduction


Every day, users of the Internet enjoy the benefits of performance and reliability provided by content delivery networks ↗ (CDNs). CDNs have become a must-have to combat latency and a requirement for any major company delivering content to users on the Internet. While providing performance and reliability for customers, CDNs also enable companies to further secure their applications and cut costs. This document discusses the traditional challenges customers face with web applications, how the Cloudflare CDN resolves these challenges, and CDN architecture and design.


Who is this document for and what will you learn?


This reference architecture is designed for IT or network professionals with some responsibility over or familiarity with their organization's existing infrastructure. It is useful to have some experience with technologies and concepts important to content delivery, including caching, DNS and firewalls.

To build a stronger baseline understanding of Cloudflare, we recommend the following resources:

What is Cloudflare? | Website ↗ (5 minute read) or video ↗ (2 minutes)

What is a CDN? | Website ↗ (5 minute read)

Analyst Report: Cloudflare named Leader in 2024 GigaOm Radar for Content Delivery Networks ↗ (20 minute read)

Those who read this reference architecture will learn:

How Cloudflare CDN can significantly improve the delivery of content to your customers

How anycast IP routing is important in ensuring reliable CDN performance

The range of tiered caching options and how to choose the one for your needs


Traditional challenges deploying web applications


Over the last several years, especially with the advent of the COVID-19 pandemic and the focus on remote work, there has been a significant growth in Internet traffic, further growing the need to efficiently manage network traffic, cut latency, and increase performance.

Companies running their applications in the cloud or on-premise are faced with the challenges of:

Implementing solutions to increase performance

As demand grows, scaling out their architecture to meet availability and redundancy concerns

Securing their environments and applications from growing Internet threats

Reining in growing costs related to doing all of the above

With companies serving customers across the globe, the above challenges require a significant undertaking. Traditionally, a website/application is deployed centrally and replicated to another region for availability, or the website/application is deployed across a handful of servers, sometimes across multiple data centers for resiliency.

The servers hosting the websites are called origin servers. When clients access a website, they make a request for resources from the server. Navigating to one website can generate hundreds of requests from the browser for HTML, CSS, images, videos, etc. With versions of HTTP prior to HTTP/2, each of these HTTP requests would also require a new TCP connection.

Enhancements in HTTP/2 and HTTP/3 allow for multiplexing multiple requests to the same server over a single TCP connection, thus saving server resources. However, compute and network resources are still consumed as servers respond to these requests. As more clients access the website, the following can result:

The origin server starts to become overloaded with requests, impacting availability; companies start looking at scaling out to handle the additional load

As each request has to make its way to the origin server, performance and user experience is impacted due to latency

The latency for end users becomes proportional to the distance between the client and origin server, thus resulting in varying experiences based on client location. This is especially true for specific countries that may experience latency due to traffic from or to that country, like China.

As origin servers respond to the increasing requests, bandwidth, egress, and compute costs increase drastically

Even as customers scale out to handle the increased demand in traffic, they are left exposed to both infrastructure-level and application-level distributed denial-of-service (DDoS) attacks

In Figure 1 below, there is no CDN present and there is an origin server sitting in the US. As clients access the website, the first step is DNS resolution, typically done by the user’s ISP. The next step is the HTTP request sent directly to the origin server. The user experience will vary depending on their location. For example, you can see the latency is much lower for users in the US, where the origin server is located. For users outside the US, the latency increases, thus resulting in a higher round-trip time (RTT).

As more clients make requests to the origin server, the load on the network and server increases, resulting in higher latency and higher costs for resource and bandwidth use.

From a security perspective, the origin server is also vulnerable to DDoS attacks at both the infrastructure and application layer. A DDoS attack could be initiated from a botnet sending millions of requests to the origin server, consuming resources and preventing it from serving legitimate clients.

Further, in terms of resiliency, if the origin server temporarily goes offline, all content is inaccessible to users.
Figure 1: HTTP Request with no CDN

How a CDN tackles web application challenges


A CDN helps address the challenges customers face around latency, performance, availability, redundancy, security, and costs. A CDN's core goal is to decrease latency and increase performance for websites and applications by caching content as close as possible to end users or those accessing the content.

CDNs decrease latency and increase performance by having many data center locations across the globe that cache the content from the origin. The goal is to have content cached as close as possible to users, so content is cached at the edge of the CDN provider's network.


Impacts



Improved website load time: Instead of every client making a request to the origin server, which could be located a considerable distance away, the request is routed to a local server that responds with cached content, thus decreasing latency and increasing overall performance. Regardless of where the origin server and clients are located, performance will be more consistent for all users, as the CDN will serve locally cached content when possible.



Increased content availability and redundancy: Because every client request no longer needs to be sent to the origin server, CDNs provide not only performance benefits, but also availability and redundancy. Requests are load balanced over local servers with cached content; these servers respond to local requests, significantly decreasing overall load on the origin server. The origin server only is contacted when needed (when content is not cached or for dynamic non-cacheable content).



Improved website security: A CDN acts as a reverse proxy and sits in front of origin servers. Thus it can provide enhanced security such as DDoS mitigation, improvements to security certificates, and other optimizations.



Reduced bandwidth costs: Because CDNs use cached content to respond to requests, the number of requests sent to the origin server is reduced, thus also reducing associated bandwidth costs.



Routing requests to CDN nodes


An important difference in some CDN implementations is how they route traffic to the respective local CDN nodes. Routing requests to CDN nodes can be done via two different methods:

DNS unicast routing

In this method, recursive DNS queries redirect requests to CDN nodes; the client’s DNS resolver forwards requests to the CDN’s authoritative nameserver. CDNs based on DNS unicast routing are not ideal in that clients may be geographically dispersed from the DNS resolver. Decisions on closest-proximity CDN nodes are based on the client's DNS server instead of client’s IP address. Also, if any changes are needed for the DNS response, there is a dependency on DNS time to live (TTL) expiration.

Further, since DNS routing uses unicast addresses, traffic is routed directly to a specific node, creating possible concerns when there are traffic spikes, as in a DDoS attack.

Another challenge with DNS-based CDNs is that DNS is not very graceful upon failover. Typically a new session or application must be started for the DNS resolver with a different IP address to take over.

Anycast routing

The Cloudflare CDN, which is discussed in more detail in the next section, uses anycast routing. Anycast allows for nodes on a network to have the same IP address. The same IP address is announced from multiple nodes in different locations, and client redirection is handled via the Internet’s routing protocol, BGP.

Using an anycast-based CDN has several advantages:

Incoming traffic is routed to the nearest data center with the capacity to process the requests efficiently.

Availability and redundancy is inherently provided. Since multiple nodes have the same IP address, if one node were to fail, requests are simply routed to another node in close proximity.

Because anycast distributes traffic across multiple data centers, it increases the overall surface area, thus preventing any one location from becoming overwhelmed with requests. For this reason, anycast networks are very resilient to DDoS attacks.


Introducing the Cloudflare CDN


Cloudflare provides a Software as a Service (SaaS) model for CDN. With Cloudflare’s SaaS model, customers benefit from the Cloudflare CDN without having to manage or maintain any infrastructure or software.

The benefits of the Cloudflare CDN can be attributed to the below two points, discussed in more detail in this section.

CDNs inherently increase performance by caching content on servers close to the user

The unique Cloudflare architecture and integrated ecosystem

Figure 2 shows a simplified view of the Cloudflare CDN. Clients are receiving their response back from a server on Cloudflare’s global anycast network closest to where the clients are located, thus drastically reducing the latency and RTT. The diagram depicts a consistent end-user experience regardless of the physical location of the clients and origin.
Figure 2: HTTP request to Cloudflare CDN with anycast

Cloudflare CDN architecture and design


Figure 3 is a view of the Cloudflare CDN on the global anycast network. In addition to using anycast for network performance and resiliency, the Cloudflare CDN leverages Tiered Cache to deliver optimized results while saving costs for customers. Customers can also
…(内容过长已截断)

------
导航页 打开网址