DNS DDoS: why authority is the first targetYou cannot cache your way out of a nameserver flood. If authority is unreachable, the CDN, the origin and the status page that shares the same zone are all gone. Put the zone on DDoS-protected Anycast.
How to hide your origin IP behind a CDNPutting a CDN in front and leaving the origin A record in old emails is not hiding. Attackers and scrapers will use the IP they already have. Cut over, then restrict.
Token authentication for CDN downloads and videoA cached object is still a public object if the URL is enough. Paid installers, embargoed video and pre-load game depots need a token at the edge so unauthorised clients never reach cache or origin.
TLS 1.3 at the edge: certificates, 0-RTT and forced HTTPSCertificates that live on a box you patch will expire at 2 a.m. Terminate TLS on the distribution. Use managed Let's Encrypt or upload a custom certificate. Redirect HTTP before origin ever sees it.- DDoS and CDNs: absorb junk at the edgeDDoS is a capacity contest. If the public IP is the origin, you brought a VM to a network fight. If the public IP is Cloud CDN, the fight happens on 200+ Tbps with the origin off to the side.
- How a CDN protects origin infrastructureThe origin should not be a public address. Visitors terminate at Cloud CDN. The origin answers the shield, not the internet at large. That is protection even before a named DDoS feature.