Content Delivery Networks

A content delivery network (CDN) serves content from edge locations close to users. It can cache static assets and, depending on the provider, proxy dynamic traffic, terminate TLS, filter attacks, and optimize connections. The origin remains the authoritative application; the CDN is an intermediary with an explicit caching and routing policy.

Connect a Domain to a CDN #

An operator configures an origin, such as https://origin.example.net, and creates a CDN distribution for www.example.com. The provider supplies a hostname such as example.cdnprovider.net; the operator then creates a DNS record that directs www.example.com to it, usually a CNAME:

www.example.com.  CNAME  example.cdnprovider.net.

At the edge, the CDN identifies the distribution using the requested hostname and forwards an appropriate Host header to the origin. Many sites can share an edge IP address because TLS SNI and HTTP’s Host header identify the intended virtual host.

The DNS apex cannot normally contain a CNAME because it must also hold SOA and NS records. Providers address this with an A/AAAA alias feature, ANAME/ALIAS records where supported, or delegated DNS. The exact behavior is DNS-provider-specific.

Choose Cache Behavior Deliberately #

Cache keys commonly include the hostname, path, selected query parameters, and selected request headers or cookies. Including every cookie destroys cache efficiency; omitting a value that changes the response can disclose one user’s content to another.

Set explicit HTTP cache directives. Versioned assets can normally be cached for a long time:

Cache-Control: public, max-age=31536000, immutable

HTML and personalized responses often need shorter lifetimes, revalidation, or private/no-store. Purge operations are useful for exceptional corrections, but content-addressed filenames and predictable TTLs are more reliable everyday invalidation mechanisms.

TLS, Origins, and Security #

The CDN certificate must cover the visitor-facing hostname. Use HTTPS from the CDN to the origin as well, validate the origin certificate, and restrict origin access so that attackers cannot bypass edge controls. Depending on the platform, this may mean firewalling to published CDN egress ranges, using mutual TLS, or requiring a signed origin request.

Do not rely on client-supplied forwarding headers for access decisions. Configure the CDN to set trusted headers and make the origin accept them only from the CDN. Review cache rules for authenticated paths, purge authorization, origin timeouts, and error caching before launch.