How Anycast Routing Works in CDNs and DNS

The short answer

Normally one IP address belongs to one place (unicast). With anycast, the same IP prefix is announced from many locations at once, called points of presence (PoPs). Internet routers pick one of those announcements for each user, and packets go to that PoP.

The user connects to one address but is served by whichever location their network considers closest.

How BGP makes it work

The internet is a set of independent networks (autonomous systems, AS) that exchange routes using BGP.

1. The CDN or DNS operator owns a prefix, for example a /24 in IPv4 or a /48 in IPv6. Smaller prefixes are usually filtered by other networks, which is why these sizes are the common minimum.
2. Every PoP announces that same prefix to its upstream providers and peers at internet exchanges.
3. Each router receives several paths to the prefix and picks one best path using BGP rules: local preference, AS path length and other attributes.
4. Traffic from a given network follows that best path to one specific PoP.

Important nuance: "closest" means closest in BGP terms, not in kilometers. A user in one city can land in a PoP in another country if their ISP has a cheaper or shorter AS path there.

Why anycast helps DNS

DNS is the classic anycast workload:

• Mostly UDP, single request–response. There is no long session, so it does not matter which PoP answers.
• Lower latency. The resolver reaches a nearby node instead of crossing continents, which speeds up every uncached lookup.
• Built-in failover. If a PoP goes down, it withdraws its announcement and BGP shifts traffic to other locations. No DNS change or TTL wait is needed.

That is why the DNS root servers, major public resolvers and most managed authoritative DNS providers use anycast.

Why anycast absorbs DDoS

In a volumetric attack, traffic comes from bots all over the world. With anycast, each bot's packets go to the PoP nearest to that bot, so the attack is split across the whole network instead of hitting one data center. Each PoP filters its share locally.

Operators can also withdraw a prefix from an overloaded location, or announce it only from sites with spare capacity, to steer traffic during an attack. Anycast is not a filter by itself, but it turns total network capacity into defense capacity.

Limitations with stateful connections

Anycast fits stateless traffic best. TCP, TLS and QUIC sessions keep state on a specific server, and that creates risks:

• Route changes mid-session. If BGP shifts while a connection is open, packets can reach a different PoP that knows nothing about the session, and the connection breaks.
• Load is not controlled precisely. BGP does not know server load, so a popular region can overload one PoP.
• Debugging is harder. Different users reach different locations for the same IP, so reproducing a problem requires knowing which PoP served them.

In practice, routes on the internet are stable enough that large CDNs successfully run HTTP over anycast. They reduce risk with stable peering, consistent hashing inside each PoP and short-lived connections. For very long sessions (large uploads, WebSockets, game servers), operators often use anycast only for the first contact and then point clients to a unicast address.

Anycast vs GeoDNS

GeoDNS returns different IP addresses depending on where the DNS query comes from. Both approaches route users to nearby servers, but in different ways.

Many CDNs combine both: anycast for DNS and edge IPs, GeoDNS or load-aware DNS to fine-tune where heavy traffic goes.

How to choose for your project

• You almost never need to build anycast yourself. Use a managed DNS provider and a CDN that already run anycast networks.
• If you need per-country routing to your own servers, start with GeoDNS or latency-based DNS from your cloud provider.
• Build your own anycast only if you operate infrastructure in several locations and are ready to own an ASN, IP space and BGP sessions.