CDN operations and observability

You shipped a hotfix at 3 AM. Origin is updated. But 20 minutes later, 40% of users are still on the old version — different CDN regions have different cache states, a stale edge in Asia-Pacific is serving yesterday’s data, and your monitoring only shows aggregate error rates that look fine. CDN incidents are invisible until they are not.

Cache-tag purge: surgical invalidation at scale

For a site with thousands of URLs (news publisher, e-commerce catalogue), URL-based purge is operationally unmanageable. Cache tags (Cloudflare Enterprise, Fastly) solve this:

1. Origin sets Cache-Tag: article-1001, category-tech on article responses.
2. On article edit, the CMS calls POST /cdn/purge {"tag": "article-1001"}.
3. CDN invalidates all cached responses carrying that tag — across all POPs, within seconds.
4. The category tag allows purging all articles in a category (tag: category-tech) in one API call.

Without cache tags: every edit triggers O(URLs) purge calls. With cache tags: every edit triggers O(tags) calls, typically 1–5.

Multi-CDN traffic steering

Large operators (Netflix, Apple, major news sites) run two or more CDNs simultaneously for:

• Vendor resilience: one CDN outage does not take the site down.
• Regional optimisation: one CDN may have better peering in Asia, another in Latin America.
• Commercial leverage: competing CDN contracts reduce per-GB costs.

Steering mechanism: DNS-based steering (NS1 Pulsar, Cedexis Openmix, custom). These aggregate real-user-monitoring (RUM) measurements and update DNS records every few seconds to route to the best-performing CDN per region. DNS TTL: 30 s for fast steering response.

Cost: operational complexity. Purges, headers, and edge-worker code must work identically on every CDN. A purge issued to CDN A does not automatically clear CDN B — each requires its own API call.

BGP-level optimisation: Argo and Global Accelerator

Anycast picks the BGP-closest POP, not the latency-closest. On intercontinental paths, BGP “closest” and “lowest latency” diverge significantly.

Cloudflare Argo Smart Routing and AWS Global Accelerator measure actual end-to-end latency from all POPs continuously and route traffic over a private backbone (not the public internet) to the lowest-latency POP. Typical saving: 30–50% reduction in p95 latency on intercontinental paths. Cost: per-GB premium pricing on backbone traversal. Worth it for latency-sensitive APIs; usually overkill for static-asset delivery where BGP is already efficient.

mTLS edge-to-origin. Even with Anycast protecting origin by obscuring its IP, attackers can discover origin IP via DNS history, certificate transparency logs, or misconfigured direct access paths. mTLS (mutual TLS): origin accepts connections only if the client presents the CDN’s certificate. Without the CDN cert, direct-to-origin requests are rejected — origin IP exposure no longer matters.

WAF and bot management at edge

CDNs sit in the request path for all traffic — making them the cheapest layer for attack defence:

• WAF (Web Application Firewall): matches request patterns against OWASP Top 10 rule sets (SQL injection, XSS, path traversal, command injection). Block in under 1 ms at edge, no origin involvement.
• Bot management: JA3/JA4 TLS fingerprinting (fingerprint the TLS ClientHello), behavioural analysis, IP reputation to distinguish human from automated traffic. Blocks credential stuffing, scraping, and API abuse.
• Rate limiting: per-IP, per-token, per-route. Configured at edge; enforced without origin round-trips.
• DDoS scrubbing: volumetric attacks (L3/L4) absorbed at edge before reaching origin. Cloudflare’s Anycast network spans 330+ cities, distributing attack traffic across all POPs.

103 Early Hints

RFC 8297 defines the 103 Early Hints informational response, sent before the final 200 OK. The edge can send Link: </style.css>; rel=preload in a 103 response while the origin generates the main HTML. The browser starts fetching critical assets before HTML arrives, saving one RTT from the critical render path. As of 2026: 93% browser support, ~5% real-world adoption. Vercel leads with ~2.8%; Cloudflare and Fastly remain below 1%. Adoption friction: the edge must know which resources to hint per page — not easily automatable without framework support.

Key observability metrics

A CDN incident often starts as a metric drift before it becomes a user complaint:

Export from CDN dashboards to Prometheus/OTel for SLO alerting. CDN-native dashboards (Cloudflare Analytics, Fastly Real-Time) are useful for deep-dive but not for cross-CDN correlation.

$ curl -I https://example.com/article/123
HTTP/2 200
date: Wed, 13 May 2026 14:33:00 GMT
content-type: text/html; charset=utf-8
cache-control: public, max-age=3600
cf-cache-status: MISS
vary: User-Agent, Accept-Encoding, Cookie, Authorization
age: 0
server: cloudflare