Anycast Routing
Same IP announced from multiple PoPs, BGP selects closest, DDoS resilience, and how 1.1.1.1 and 8.8.8.8 work.
Overview
Overview Anycast is a network addressing and routing method where the same IP address is announced from multiple geographically distributed locations (Points of Presence, or PoPs). BGP selects the "closest" PoP based on AS path length and routing policy, so a client in Tokyo reaches the Tokyo PoP while a client in Frankfurt reaches the Frankfurt PoP — both using the same destination IP.
The mechanism works through BGP route announcements. Each PoP originates a BGP route for the same prefix (e.g., 1.1.1.1/32). BGP routers on the Internet receive multiple paths to the same prefix and select the best path based on the BGP decision process — typically shortest AS path, then lowest MED.
Anycast is the foundation of the public DNS infrastructure. Cloudflare's 1.1.1.1, Google's 8.8.8.8, and all 13 DNS root server clusters use anycast. Every DNS resolver in the world reaches its nearest instance, distributing the query load globally.
DDoS resilience is a key operational benefit: a volumetric attack (e.g., 1 Tbps UDP flood) is absorbed across all PoPs simultaneously rather than overwhelming a single IP's physical infrastructure. Cloudflare Magic Transit, AWS Global Accelerator, and Akamai all use anycast as the core mechanism for DDoS absorption.
The tradeoff is that anycast is not designed for TCP sessions that span routing changes: if a client's traffic shifts to a different PoP mid-session (due to BGP convergence), the TCP connection breaks. This makes anycast ideal for stateless protocols (DNS/UDP) and short-lived TCP connections.
Key concepts
- Anycast
- A routing scheme where the same IP prefix is announced from multiple locations. BGP routes each client to the topologically nearest PoP. Used by DNS resolvers, CDNs, and DDoS scrubbing services.
- BGP Route Announcement
- Each PoP uses BGP to advertise the anycast prefix to its upstream ISPs. The rest of the Internet learns multiple paths to the same prefix and each router selects the best path based on AS path length and policy.
- PoP (Point of Presence)
- A physical location where a network operator has deployed servers and BGP routing infrastructure. Each PoP independently announces the anycast prefix and handles traffic routed to it.
- GeoDNS vs Anycast
- GeoDNS returns different A records based on the resolver's IP geolocation. It requires DNS TTL expiry to reroute. Anycast routes at the IP layer with no DNS dependency and is faster to converge.
- DDoS Absorption via Anycast
- A volumetric DDoS targeting an anycast IP is spread across all PoPs simultaneously. Each PoP absorbs a fraction of the attack traffic, preventing any single location from being overwhelmed.
When to use it
- Designing a globally distributed DNS or API endpoint that routes users to the nearest PoP
- Explaining how DDoS scrubbing services absorb volumetric attacks across multiple locations
- Comparing anycast with GeoDNS as strategies for latency reduction
- Understanding how AWS Global Accelerator and Cloudflare Magic Transit work under the hood
Interview questions
- How does anycast work, and how does it provide DDoS resilience?
- Compare anycast with GeoDNS. When would you use each?
Sign up free to read the full topic
More Networking topics
Start free on Cariara · Coding problems · System design studio