- DNS DDoS: why authority is the first targetYou cannot cache your way out of a nameserver flood. If authority is unreachable, the CDN, the origin and the status page that shares the same zone are all gone. Put the zone on DDoS-protected Anycast.
- How to hide your origin IP behind a CDNPutting a CDN in front and leaving the origin A record in old emails is not hiding. Attackers and scrapers will use the IP they already have. Cut over, then restrict.
- Token authentication for CDN downloads and videoA cached object is still a public object if the URL is enough. Paid installers, embargoed video and pre-load game depots need a token at the edge so unauthorised clients never reach cache or origin.
- TLS 1.3 at the edge: certificates, 0-RTT and forced HTTPSCertificates that live on a box you patch will expire at 2 a.m. Terminate TLS on the distribution. Use managed Let's Encrypt or upload a custom certificate. Redirect HTTP before origin ever sees it.
- DDoS and CDNs: absorb junk at the edgeDDoS is a capacity contest. If the public IP is the origin, you brought a VM to a network fight. If the public IP is Cloud CDN, the fight happens on 200+ Tbps with the origin off to the side.
- How a CDN protects origin infrastructureThe origin should not be a public address. Visitors terminate at Cloud CDN. The origin answers the shield, not the internet at large. That is protection even before a named DDoS feature.