Skip to main content
cdn

CDN (Content Delivery Network)

A globally distributed cache that serves static and cacheable dynamic content close to the user.

Why it exists

The speed of light is a fixed cost. If your origin is in Virginia and your user is in Sydney, a round trip is 200ms of pure network — before you've done anything useful. CDNs solve this by pushing bytes to hundreds of PoPs around the world; the user's request terminates at the nearest edge, not at your origin. Result: 20ms instead of 200ms, and the origin is protected from 90%+ of traffic.

How it works

A user's DNS lookup resolves to a nearby edge PoP (via Anycast or geo-DNS). The edge checks its cache; if hit, it serves the response directly. If miss, it fetches from origin, caches per the response headers (`Cache-Control`, `Surrogate-Control`), and serves. Modern CDNs support edge functions (Cloudflare Workers, Lambda@Edge) so you can run code at the PoP, not just serve files. Purge/invalidate happens via API when content changes.

Scaling characteristics

CDN capacity is measured in bandwidth (Tbps) and cache hit ratio (higher = less origin load). Adding PoPs adds capacity linearly. Hit ratio is a function of cacheability (static: 99%+, dynamic HTML: 30-70%) and cache eviction policy (LRU with configurable TTL). Cost model: pay per GB egress, cheaper as volume grows.

When to use it

  • You have any static assets (images, CSS, JS)
  • You have geographically distributed users
  • You need protection against DDoS (CDNs absorb malicious traffic)
  • Your dynamic responses have any cacheability (personalized-but-not-user-unique)

When NOT to use it

  • Fully personalized responses that must always hit origin (though even here, edge auth checks help)
  • Ultra-low-latency real-time (gaming, trading) — you want dedicated network, not a shared cache

Failure modes

  • Cache stampede on eviction — if a hot key expires, N PoPs all fetch from origin simultaneously. Mitigation: origin-shield tier + coalesced fetches.
  • Cache poisoning via header manipulation — cache pollution can serve wrong content to millions
  • Purge lag — API says purged, but cached copies serve for seconds; mitigation: cache-busting query strings + versioned URLs
  • PoP outage routes traffic to farther PoPs, raising latency and origin miss rate

Alternatives

  • Reverse proxy at your origin (Varnish, Nginx) — cheap for single-region, no distribution benefit
  • Origin-only with heavy Redis cache — works for smaller scale but doesn't help TCP round-trip latency
  • Peer-to-peer (BitTorrent-style) — worked for large downloads, mostly irrelevant now

Interview questions

  • How does the CDN decide which PoP to serve from?
  • What happens when your origin goes down but the CDN still has cache?
  • How would you prevent a cache stampede on a hot key?
  • How would you version cacheable assets so purges are instant?
  • What's your cache hit ratio target for static vs dynamic content, and why?
  • How does the CDN protect you from a DDoS?

Systems that use this component

See how the real designs on this platform put cdn to work — concrete usage context per system.

URL Shortener

beginner

L6+ CDN caches redirects at edge with 5-min TTL, 95% origin offload

Open system

Netflix

intermediate

Open Connect — Netflix's custom CDN with 20K+ edge servers embedded in ISPs

Open system

YouTube

intermediate

Delivers video segments (HLS/DASH) from ~150 CDN edge locations

Open system

Twitter/X timeline

intermediate

Caches static assets (images, videos, avatars) at edge

Open system

Instagram

intermediate

Photo delivery via CloudFront; hot posts pre-warmed

Open system

Dropbox

intermediate

Metadata caching at edge; block downloads via CDN for hot files

Open system
The story of edge networks

1998, MIT: two mathematicians decide the internet is too slow

Tim Berners-Lee walked into Tom Leighton's office at MIT in 1995 and asked a simple question: "When your homepage becomes famous, the web crumbles. Can math fix it?"Leighton, an applied-math professor working on parallel algorithms, teamed up with his grad student Danny Lewin — and in 1998, they founded Akamai. Their insight: if the origin is 200ms away, put a copy 20ms away. Distribute the content across hundreds of servers globally, and route each user to the closest one.

Lewin died on September 11, 2001 — one of the first casualties, aboard American Airlines Flight 11. The infrastructure he helped build, ironically, was what kept CNN and the New York Times online that day when traffic spiked 50×. Akamai's CDN absorbed the flood while origins stayed protected.

The idea proved so foundational that today ~70% of all internet traffic flows through a CDN. Netflix went further and built Open Connect (2011) — appliances installed inside ISPs, so a Netflix movie streams over your ISP's local network, never crossing the public internet. Cloudflare took it in the other direction with Workers (2017) — arbitrary V8 code running at 300+ edge PoPs in <10ms cold start. The CDN is no longer just a cache; it's a global compute mesh.

The core lesson: the speed of light is a fixed cost you cannot optimize away in code. A round trip from Mumbai to Virginia is ~250ms. The only way to beat physics is to move the data closer. That's what a CDN does — and once you have edge presence, you can put more than cached bytes there: images, HTML, API responses, authentication, personalization, even entire application logic.

Latency without a CDN
Mumbai → Virginia~220ms
Sydney → Frankfurt~280ms
São Paulo → Tokyo~290ms
With a CDN edge
Mumbai → Mumbai PoP~8ms
Sydney → Sydney PoP~6ms
São Paulo → SP PoP~9ms
~30× faster — and origin sees ~5% of traffic instead of 100%. That's not an optimization; it's a different physics regime.

Historical timeline

  1. 1995
    The problem is named
    Tim Berners-Lee tells Tom Leighton at MIT that popular sites "crash the web". Leighton's parallel-algorithms lab starts thinking about content distribution.
  2. 1998
    Akamai founded
    Tom Leighton + Danny Lewin commercialize consistent-hashing-based routing. First customer: Apple. Powers the launch of the iTunes Store.
  3. 1999
    Akamai handles ESPN March Madness
    First large-scale demo — 400,000 concurrent streams. Origin didn't buckle. CDN as a category is born.
  4. 2001
    9/11 stress test
    News sites see 50× traffic spikes. Akamai's edge absorbs it. Enterprises decide CDN is not optional.
  5. 2008
    Amazon CloudFront launches
    First cloud-native CDN — pay per GB, no contracts. Democratizes CDN access.
  6. 2009
    Cloudflare founded
    Matthew Prince + Michelle Zatlyn build a CDN with DDoS protection + free tier. Adds security to the CDN value prop.
  7. 2011
    Netflix Open Connect
    Custom appliances installed inside ISPs. ~90%+ of Netflix bytes never touch the public internet.
  8. 2013
    HTTP/2 arrives
    Multiplexing over one TCP connection changes CDN economics — one warm connection to origin can serve many requests.
  9. 2015
    Fastly + Varnish + instant purge
    Fastly proves you can invalidate cached content globally in <150ms. Makes CDN viable for dynamic content.
  10. 2017
    Cloudflare Workers launches
    Arbitrary V8 JavaScript at 200+ PoPs, <10ms cold start. The CDN becomes a compute platform, not just a cache.
  11. 2018
    AWS Lambda@Edge + CloudFront Functions
    AWS follows suit. Every CDN now has an edge-compute story.
  12. 2020
    Vercel + Netlify build on top
    Deploy-to-edge frameworks make edge deployment the default for new web apps.
  13. 2022
    QUIC + HTTP/3 rollout
    UDP-based transport eliminates head-of-line blocking. CDNs are the first to deploy it globally.
  14. 2024
    AI inference at the edge
    Cloudflare Workers AI, Fastly Compute — LLM inference on 300+ PoPs. Latency-sensitive AI moves to CDN.

Edge PoP map: pick a user, see the latency

A CDN puts PoPs (Points of Presence) globally. When a user makes a request, DNS/Anycast routes them to the nearest PoP — not the origin. Click a user location below and watch what changes.

World map (schematic)
Mumbai PoPLondon PoPNew York PoPSydney PoPSão Paulo PoPTokyo PoPCairo PoPOrigin (VA)
Direct to origin
220ms
Every request crosses continents. Origin CPU/DB does all the work.
Via CDN edge
8ms
Cache hit → served from PoP. 28× faster. Origin sees ~5% of traffic.
Notice Cairo: 22ms to nearest PoP (further away) — CDN quality depends on PoP density. Cloudflare has ~300 PoPs, Fastly ~90, Netflix Open Connect operates directly inside ~1000+ ISPs. More PoPs = better tail latency but higher operating cost.

Cache-Control header: the CDN's instruction manual

The origin's Cache-Control header is what makes CDN caching predictable. Get it right, and you get 99%+ hit ratios. Get it wrong, and your origin melts. Try each pattern:

Response header
Cache-Control: public, max-age=31536000, immutable
Applied to: app.a3f8b2.js (versioned filename)
CDN behavior
CDN + browser cache for 1 year. Never revalidate.
Hit ratio
99.9%
Revalidation
Never — deploy new version → new filename → new URL.
Use case: JS bundles, CSS, hashed images, fonts.
Golden rule: versioned URLs + immutable is the highest-ROI cache config you can ship. It moves your hit ratio from 60% to 99% and costs one build-step change.

Six invalidation strategies (ranked by production sanity)

Getting content into the CDN is easy. Getting it out when it changes — that's where CDN architecture gets hard. Six patterns you should know:

Versioned URLs (fingerprinting)
Best default

Speed: Instant globally
How: app.js → app.a3f8b2c9.js. New build = new URL.
Cost: Free
Complexity: Low — build tool does it
When: Static assets. THE default.
Pros: Zero purge lag, works everywhere, no cache thrash.
Cons: Needs build tooling. HTML that references the assets still needs its own strategy.

TTL expiry

Speed: 0–60 seconds
How: Cache-Control: max-age=60. Wait for it to expire.
Cost: Free
Complexity: Low
When: Content that's allowed to be slightly stale.
Pros: Zero API calls, self-healing.
Cons: Can&apos;t force refresh. Bad for urgent updates (breaking news, security patches).

API purge (single URL)

Speed: ~150ms (Fastly) to ~5 min (CloudFront)
How: POST /purge { url: '/article/123' }
Cost: $0.005/purge (CloudFront) or free (Cloudflare, Fastly).
Complexity: Medium — must integrate with publishing workflow.
When: CMS-style: publish article → purge that URL.
Pros: Precise, targeted.
Cons: Have to know every URL to purge. Slow on some CDNs.

Tag-based purge (surrogate keys)

Speed: &lt;150ms (Fastly, Cloudflare)
How: Origin sets Surrogate-Key: user-42, article-tag. Purge by key.
Cost: Free / minor
Complexity: Medium — origin annotates responses.
When: Complex invalidation: user updates profile → purge everything tagged user-42.
Pros: One purge invalidates many URLs. Cascading invalidation.
Cons: Not all CDNs support (Fastly best, CloudFront doesn&apos;t).

Wildcard/prefix purge

Speed: Seconds to minutes
How: POST /purge { prefix: '/images/*' }
Cost: Free / metered
Complexity: Low
When: Nuclear option — flush a section.
Pros: Simple.
Cons: Blast radius large. Can cause origin thundering-herd.

Purge everything (nuke)

Speed: Instant, but recovery is slow.
How: One API call. Everything gone.
Cost: Free (dangerous free)
Complexity: Trivial
When: Almost never in production. Emergency only.
Pros: Guarantees fresh content.
Cons: Origin gets hit with ALL traffic simultaneously. Real risk of outage.

Origin shield: preventing the cache-miss stampede

When a popular object expires or gets purged, every edge PoP misses simultaneously — all N of them hammer origin at once. This is the cache stampede. Origin shield adds a mid-tier of PoPs between edges and origin. All edges route misses through the shield, which collapses N misses into 1 request to origin.

Edge PoPs
PoP1
PoP2
PoP3
PoP4
PoP5
PoP6
PoP7
PoP8
PoP9
PoP10
PoP11
PoP12
12 PoPs miss same key
Origin Shield PoP
↓ collapses 12 → 1
Origin
1 request
1 / 12 = 8% origin load
Real numbers: Netflix reports origin shield collapses their global miss rate from ~10% to <0.1%. That's 100× less origin load. Similar for The Guardian, BBC, Vimeo, and other top publishers.
Trade-off: Shield adds one extra hop for cold-cache requests (~10ms). Net win only if you have many PoPs actively serving the same hot content. Not worth it for pure static assets already at 99% hit.

How does a request even reach the nearest PoP? Anycast vs Geo-DNS

The CDN's magic depends on routing you to the closest PoP. Two techniques dominate — and they behave very differently under failure:

Anycast (Cloudflare, Fastly, Google)

Same IP address announced from every PoP via BGP. Internet routing naturally picks the closest one. Route changes at layer 3 — the network itself decides.

$ dig 1.1.1.1
→ 1.1.1.1 (same everywhere)
# BGP delivers you to nearest PoP
Failure mode: A PoP dies → BGP withdraws → next-closest PoP absorbs. Sub-second.
Trade-off: A user's route can flap mid-connection if BGP updates → hard for stateful protocols.
Best for: Static content, DNS, stateless APIs, edge functions.

Geo-DNS (Akamai, older CloudFront)

DNS resolver returns different IP based on the client's IP location. Different PoPs = different IPs. Routing decision happens at DNS resolution time.

$ dig cdn.example.com
→ India user: 13.226.11.14
→ US user: 143.204.88.22
Failure mode: A PoP dies → wait for DNS TTL (~30s-5min) before clients notice.
Trade-off: Sticky routing — good for stateful. Slow failover — bad for availability.
Best for: Video streaming, long-lived connections, session-heavy apps.
Modern reality: Most CDNs use both. Anycast for the entry IP, then internal Geo-DNS-like logic inside the PoP mesh to route to the best backend. Cloudflare has been anycast-first since day one; Akamai layers geo-DNS with intelligent RUM-based routing.

Edge compute: when the CDN becomes an application platform

For the first 20 years, CDNs were dumb caches. Around 2017, that changed: Cloudflare Workers, Lambda@Edge, and Fastly Compute@Edge let you run arbitrary code at every PoP. Now the CDN is your global application runtime.

Auth at edge

Verify JWT, check API key, block bots — before the request ever leaves the PoP. Origin never sees unauthorized traffic. 20ms vs 200ms.

Cloudflare Access, Fastly VCL.

A/B testing

Split traffic 50/50 at edge based on cookie. No origin call needed just to pick a variant. Coherent experience.

Vercel Edge Middleware, Netlify Edge Handlers.

Image transformation

User requests /image.jpg?w=800. Edge resizes on-the-fly, caches result. Origin stores one master image.

Cloudflare Images, Fastly IO, Vercel Image Optimization.

Personalization

Read a cookie/header, rewrite the HTML response with the user's name/preferences. Cached response, personalized delivery.

ESI (Edge Side Includes), Cloudflare Workers.

Geo-blocking / compliance

GDPR? Show cookie banner only for EU users. Block export-restricted content. Enforced at edge, not app.

Any Workers/Lambda@Edge.

AI inference

Run small models (embedding, classification, translation) at PoP. Latency-sensitive AI without a round trip to origin.

Cloudflare Workers AI, Fastly Compute@Edge with WASM.
The shift: If a piece of logic doesn't need origin data, it belongs at the edge. Every ms of latency you shave off the P99 comes from moving code closer, not making origin faster. This is why Vercel and Netlify built entire frameworks around edge-first architecture.

Product comparison

ProviderPoPsSpecialityPricingStrengthWeakness
Cloudflare300+Widest PoP network + free tier + WorkersFree tier / from $20/moDDoS protection, edge compute, simpleSupport for enterprise workloads improving
Akamai4,100+The oldest, largest enterprise CDNEnterprise contracts ($$$)Video, media, telco integrationComplex, expensive, dated UX
Fastly~90Instant purge (<150ms), Varnish-basedPay-as-you-go, ~$0.12/GBFastest purge, dev-friendly VCL, dynamic contentFewer PoPs → tail latency in emerging markets
AWS CloudFront600+Deeply integrated with AWS (S3, Lambda@Edge)~$0.085/GB (first TB)AWS stack integration, cheap at scale, matureSlower purge, more complex config
Google Cloud CDN200+Uses Google's private backbone~$0.08/GBDirect integration with GCP, fast fill from originSmaller PoP footprint, GCP-lock-in
Bunny CDN119Simple + cheap, developer-first$0.01–$0.06/GBBest price/perf for small-medium sitesLimited enterprise features, no massive scale
Vercel Edge Network40+Next.js-native, edge functions built inTied to Vercel planZero-config edge compute for React/Next.jsFramework lock-in, expensive at scale
Netlify Edge6 core regionsDeno-based edge functionsTied to Netlify planSimple deploy, JAMstack nativeFewest PoPs of the modern platforms
Netflix Open ConnectN/A (custom appliances)Boxes installed inside ISPsFree to ISPs (Netflix pays)&gt;90% of Netflix bytes never touch public internetOnly for Netflix — not a general-purpose CDN

How to choose: Static-heavy + small budget → Bunny. AWS shop → CloudFront. Need instant purge for a news site → Fastly. Want edge compute + free tier → Cloudflare. Video streaming at scale → Akamai or Open Connect. Building a Next.js app → Vercel Edge.

12 real-world CDN patterns

Netflix

Open Connect: the CDN inside your ISP

Netflix installs ~10,000 physical appliances (~280TB flash storage each) inside ISPs worldwide. When you press play, the movie streams from a box in your ISP's datacenter — <5ms away. Comcast, Verizon, BT all host Open Connect. This is why Netflix's peak-hour traffic (~15% of global internet) doesn't crash the internet — because it never enters the public internet.

YouTube

Google Global Cache: same idea, different scale

Google places Google Global Cache boxes in 1,500+ ISPs. YouTube videos, Google Play apps, Google Search — all cached inside your local network. When you watch YouTube, ~85% of bytes come from a GGC in your ISP's rack. Cost saving to Google: billions/year. Latency savings to you: 10× faster start.

Cloudflare Workers

Discord serves 15M concurrent users with edge compute

Discord routes voice/chat metadata through Cloudflare Workers at 300+ PoPs. Auth, rate limiting, protocol translation — all at edge. Origin (their Go/Elixir services) only sees traffic that's already validated. Saves ~40% infra cost + P99 latency drops from 180ms → 30ms.

Spotify

Fastly Compute@Edge for A/B tests

Spotify runs A/B tests at the edge — the CDN decides which variant of the homepage you see based on cookies + rollout config, before any origin call. Cached HTML per variant. Origin serves 1000× less traffic during experiments than if every variant went through app servers.

Reddit

Fastly + surrogate keys for granular purge

Reddit uses surrogate-key tagging on Fastly. Every subreddit page tagged with subreddit-{name}. When a mod pins a post, they purge by tag → all cached URLs for that subreddit invalidate in <150ms globally. No wildcard sledgehammer, no origin stampede.

Cloudflare 1.1.1.1

Anycast DNS: 100M queries/sec, no geo-DNS

The 1.1.1.1 public DNS resolver is a pure anycast play. Same IP announced from 300+ PoPs. Wherever you are, BGP delivers your query to the closest PoP — median resolve time <14ms globally. Zero configuration, zero DNS-based routing. Anycast handles it all.

The Guardian

Fastly + stale-while-revalidate for breaking news

The Guardian uses stale-while-revalidate for article HTML. Cache TTL: 60s. During a breaking-news spike, readers get instant response (from stale cache) while Fastly refreshes in background. Origin sees maybe 10 QPS while edge serves 200,000 QPS. No downtime, no thundering herd.

Vercel

Edge Middleware for Next.js: 40+ PoPs

Every Vercel deploy runs its middleware.ts at 40+ Vercel Edge PoPs. Auth, redirects, personalization, geo-restrictions — all happen at edge in <10ms. The origin serverless function only runs when it must. Result: P75 first-byte latency <100ms globally.

Shopify

CDN for storefronts: 4M merchants, 1 CDN config

Shopify runs all 4M merchant storefronts through Fastly + custom edge logic. Product pages cached at edge with surrogate keys per product. When a merchant updates a price, only that product's cached pages invalidate. Cyber Monday scale — 76M req/min — handled without merchants noticing.

Twitch

Live video at scale with CloudFront + custom origin

Twitch pushes ~30M concurrent live viewers through CloudFront + custom HLS chunk caching. Each 2s video chunk cached at edge for the ~5-second livestream buffer window. Origins do encoding once, edges fan it out to millions. Peak: ~200Tbps globally.

Cloudflare Images

On-the-fly image resize at edge

You upload one master image. Users request ?w=800&q=80. Cloudflare's edge resizes on demand, caches the variant, serves in ~30ms. Origin never sees resize traffic. Saves ~90% egress bandwidth vs pre-generating every size. Used by Wix, Squarespace, DoorDash.

OpenAI ChatGPT

Cloudflare for API rate limiting + DDoS

OpenAI fronts the ChatGPT API with Cloudflare. Rate limiting per API key at edge (Cloudflare Rate Limiting Rules). DDoS mitigation absorbs attacks. TLS termination global. Origin (their GPU cluster) never sees a non-legitimate request. Cost savings: 100M+/year in bad-traffic filtering.

Key takeaways

  • 1A CDN's core value is latency reduction via proximity. It's the only way to beat the speed of light for global users.
  • 2Cache-Control + versioned URLs are the highest-ROI change you can make. Aim for 99%+ hit ratio on static assets.
  • 3Origin shield eliminates cache stampedes when popular content expires. 100× less origin load in real production.
  • 4Anycast (Cloudflare, Fastly) fails over instantly. Geo-DNS (Akamai) fails slowly. Choose by workload sensitivity.
  • 5Modern CDNs are compute platforms, not just caches. Push auth, A/B tests, personalization, image transforms to the edge.
  • 6For instant global purge, prefer Fastly or Cloudflare. CloudFront's purge is minutes-scale — plan around it.
  • 7Netflix Open Connect proves the ultimate CDN move: put the cache inside the ISP. Only viable if you're Netflix, YouTube, or a similar giant.
  • 8The CDN also protects origin from DDoS. Bad traffic never reaches your infra — the CDN absorbs it. Free security bonus.

References & further reading

  • • Leighton, F. T. (2009). "Improving Performance on the Internet." Communications of the ACM 52(2). The Akamai co-founder's classic overview.
  • • Nygren, E., Sitaraman, R. K., & Sun, J. (2010). "The Akamai Network: A Platform for High-Performance Internet Applications." ACM SIGOPS OSR. The definitive Akamai architecture paper.
  • • Adhikari, V. K., et al. (2012). "Unreeling Netflix: Understanding and Improving Multi-CDN Movie Delivery." IEEE INFOCOM. Pre-Open-Connect era analysis of Netflix.
  • • Cloudflare (2017). "Introducing Cloudflare Workers." Blog post that launched edge compute as a category.
  • • Fastly (2019). "Compute@Edge: WebAssembly at the edge." Whitepaper on WASM-based edge compute.
  • • Berners-Lee, T., et al. (1994). "The World-Wide Web." Communications of the ACM. The problem CDNs solve, articulated by the guy who created the problem.
  • • Netflix Tech Blog: "Open Connect Everywhere: A Global Content Delivery Network" (2016). Deep dive on the custom appliance CDN.
  • • Grigorik, I. (2013). High Performance Browser Networking. O'Reilly. Chapter 11 covers CDN fundamentals with clarity.
  • • MDN Web Docs: "HTTP caching" and "Cache-Control." The reference for header semantics.
  • • Cloudflare Learning Center: "What is a CDN?", "Anycast vs Unicast", "Origin shield." Vendor docs but genuinely educational.