Why a lookup shows the CDN, not the origin
Visitor
looks up the domain
CDN edge
104.21.x.x
this is what DNS returns
Origin server
real IP, never exposed
Why a CDN Shows Its IP Instead of the Origin Server IP
You look up a major website expecting its server address, and get something belonging to Cloudflare, Fastly, or Akamai instead. Nothing has gone wrong. You are seeing exactly what the domain publishes — and the real server's address was never in DNS to begin with.
Why a lookup shows the CDN, not the origin
Visitor
looks up the domain
CDN edge
104.21.x.x
this is what DNS returns
Origin server
real IP, never exposed
What a CDN actually does
A content delivery network is a fleet of servers distributed across the world. Instead of every visitor connecting to your single origin server, they connect to whichever CDN node is nearest, which serves cached content directly and fetches anything it lacks from the origin.
The performance argument is straightforward: a visitor in Singapore connecting to a server in Virginia pays roughly 200ms of round-trip latency on every request. A Singapore edge node cuts that to a few milliseconds for cached content.
For this to work, the domain must resolve to the CDN rather than the origin. That is not a side effect — it is the entire mechanism. If DNS returned your origin address, visitors would connect to it directly and the CDN would never be involved.
How to recognise a CDN address
- Reverse DNS names the provider. The address resolves to something like
*.cloudflare.com,*.fastly.net, or*.cloudfront.net. See reverse DNS. - The same address serves many unrelated sites. Edge nodes are shared infrastructure by design.
- Different locations get different answers. Geo-routing sends you to your nearest node, so the address varies by where you query from.
- The
CNAMEpoints at a provider hostname. A record likewww.example.com CNAME example.com.cdn.cloudflare.netis unambiguous.
dig +short example.com
dig +short -x 104.21.32.47The second command is a reverse lookup. If it returns a provider's hostname, you have your answer.
Why the origin is hidden deliberately
Concealment is not a byproduct. It is a security property people pay for.
| Threat | What hiding the origin achieves |
|---|---|
| DDoS attack | Attack traffic hits the CDN's capacity, not your single server. This is the primary reason large sites use one. |
| Direct exploitation | Attackers cannot reach the origin without first finding it, so scanning and probing hit the edge instead. |
| Bypassing the WAF | If the origin were reachable directly, every firewall rule at the edge could simply be skipped. |
| Rate-limit evasion | Limits enforced at the edge cannot be circumvented by connecting behind them. |
What this means for a lookup result
It changes how you should read the answer, not whether the answer is correct.
Key takeaway
A lookup tells you where traffic for this domain is directed right now. For a CDN-fronted site, that is the edge — which is genuinely the correct, useful, and only public answer.
Practical consequences:
- Geolocation is meaningless. The edge node's city tells you where you are routed, not where the business or its data sits.
- Reverse IP lookups are noise. Thousands of unrelated domains legitimately share one edge address.
- The address is unstable. CDNs reassign edge addresses constantly. Do not hardcode it or build firewall rules around it.
- Blocking it blocks everyone. Blocking a shared edge address affects every site behind that node.
A note on trying to find the origin anyway
Articles exist describing techniques for unmasking origin servers — historical DNS archives, certificate-transparency logs, subdomains that were never moved behind the CDN, email headers from mail sent by the origin.
All of them work by exploiting a mistake the target made, not by defeating the CDN. And the reason someone hid an origin is usually that they are being attacked. Probing another organisation's infrastructure to defeat a protection they deliberately deployed is not a neutral act, and in many jurisdictions it is not a legal one either.
The lookup tool shows the full public record set for any domain, including the CNAME chain — which is usually the quickest way to confirm a site is CDN-fronted at all.
Need to check a domain's public DNS addresses? Use the Domain IP Lookup tool.
Frequently asked questions
Related reading
One hostname, several A records
1st answer
93.184.216.34
2nd answer
93.184.216.35
3rd answer
93.184.216.36
The resolver hands back every record, usually in rotating order
Why One Domain Can Have Multiple IP Addresses
Four different mechanisms produce several addresses for one name. Telling them apart explains why your answer differs from someone else's.
What is actually behind the address you resolved
Shared IP
Many sites on one address -- the Host header picks yours
Dedicated IP
Only you -- you control its reverse DNS
CDN edge
Not the origin -- the edge terminates the connection
Shared vs. Dedicated IP Addresses: Differences and Use Cases
The honest answer: most websites do not need a dedicated IP. Here is when it genuinely matters, and which supposed benefits are myths.
A recursive DNS lookup, one hop at a time
Browser
wants example.com
Resolver
your ISP / 1.1.1.1
Root + TLD
who runs .com?
Authoritative
the real answer
Every hop down this chain is itself a DNS lookup, cached afterward
How to Find the IP Address of a Website or URL (5 Methods)
What is the IP address of a website? Five ways to find the IP address of any website or URL, with exact commands for Windows, macOS, and Linux.