When you click a link, your browser does not have to go all the way to the original server to bring you the page: many times it receives it from a server much closer to your home. That is the job of a CDN (Content Delivery Network), an infrastructure that replicates content across hundreds or thousands of nodes scattered around the planet. This article explains how it works under the hood.
The problem: latency
The Round Trip Time (RTT, the round-trip time of a packet) grows with physical distance. Each hop between routers adds milliseconds and, when the server is thousands of kilometers away, the wait is noticeable. Moreover, a single central server is a bottleneck: if millions of users request the same thing at once, the response degrades or the service goes down. The CDN solves both by bringing content closer to the user and spreading the load across many nodes.
Edge nodes and PoPs
The CDN deploys hundreds of PoPs (Points of Presence): small data centers distributed across the world’s main cities and regions. Inside each PoP there are dozens or hundreds of edge servers that cache copies of the content. When you request a resource, your request is resolved to the nearest PoP, not to the origin.
The edge servers use SSD disks and high-speed memory to serve content with minimal latency. Static content (images, CSS, JavaScript, video) is literally stored on those disks; dynamic and personalized content is usually generated at the origin and, in many cases, is also cached intelligently.
Routing: Anycast
The key technique for knowing which PoP serves you is Anycast routing. Instead of each server having a unique IP, the whole CDN advertises the same IP address from all its PoPs using the BGP protocol (Border Gateway Protocol, the one that decides routes between networks on the internet). When your router sees several routes to that same IP, it picks the “shortest” one according to the BGP cost, which usually matches the one with the lowest latency. Thus, a single DNS name resolves to the same IP, but each user ends up connected to the physically nearest node.
Name servers and resolution
The CDN also controls the DNS (Domain Name System, the system that translates names into IPs). Its name servers respond differently depending on who asks: they examine the IP of your resolver (the DNS server that asks on your behalf) and return the IP of the nearest PoP. This is combined with Anycast: first DNS points you to the correct region and then BGP finishes fine-tuning within that region.
Caching and purging
The edge server decides what to store based on the HTTP headers sent by the origin. The Cache-Control header indicates how long a resource is valid (max-age) and whether it can be cached (public or private). ETag and Last-Modified allow validation: the edge server asks the origin whether the content changed and only re-downloads it if necessary. When the operator publishes new content, it triggers a purge (invalidation) that removes the old copies from all PoPs and forces the fresh version to be re-cached.
TLS termination and security
Modern CDNs manage TLS certificates (Transport Layer Security, the encryption of HTTPS) at the edge. The domain’s certificate is installed on every edge server, so encryption terminates at the PoP and not at the origin. Between the PoP and the origin, an encrypted internal connection or even a private network can be used, so as not to expose the original server: its real IP stays hidden behind the CDN, which also protects against direct attacks.
This role at the edge turns the CDN into a natural shield against distributed denial-of-service attacks (DDoS): the edge nodes absorb massive traffic, apply rate limiting (limiting requests per second) and filter malicious requests before they reach the origin.
Dynamic content and edge computing
The CDN no longer serves only static content. Edge computing allows running code on the edge servers, very close to the user, through platforms such as Cloudflare Workers, Fastly Compute or Vercel Edge. These functions run on WebAssembly or V8 isolates and can personalize responses, rewrite HTML or call APIs in milliseconds, without each request travelling all the way to the origin.
Deployment models and real-world examples
There are CDNs of different types: some are pull, where the node fetches content from the origin only when it is requested; others are push, where the operator uploads the content directly to the nodes. The big players — Cloudflare, Akamai, Fastly, AWS CloudFront — combine both depending on the use case. Streaming video is one of the biggest beneficiaries: video segments are cached on thousands of nodes to serve millions of viewers without saturating a single data center.
Conclusion
The CDN is the invisible infrastructure that makes the internet feel instant: it shortens distances with Anycast, spreads the load across thousands of nodes, caches content at the edge and also protects the origin. The next time a page loads instantly, think that it probably did not travel thousands of kilometers: it was stored just a few from your home.
