Moving a website onto a CDN usually means taking the CDN's IP addresses and updating every partner firewall that allowlisted the old ones. BYOIP avoids that by letting the provider route addresses you already own.
Key Takeaways
- BYOIP (bring your own IP) lets a cloud or CDN provider announce IP prefixes you own.
- Providers usually require at least a /24 for IPv4 or a /48 for IPv6, plus an RPKI ROA.
- In a multi-CDN setup, each prefix is announced by one CDN at a time.
- RPKI and planned withdrawals protect your prefixes from hijacks and outages.
What Is BYOIP?
BYOIP, short for bring your own IP, means a provider such as Cloudflare or AWS advertises your public IP addresses from its network instead of assigning its own. The addresses stay registered to you with a registry such as ARIN or RIPE NCC, and the provider only gets permission to route them. Most providers accept nothing smaller than a /24 for IPv4 or a /48 for IPv6, because many networks filter smaller routes. For teams that own address space, BYOIP becomes part of IP address management.
{{cool-component}}
How BYOIP Works at the Network Level
BYOIP relies on BGP routing, the protocol networks use to tell each other which addresses they can reach. Onboarding at most providers looks like this:
- Prove you control the prefix, for example with a signed message or a DNS TXT record.
- Create a Route Origin Authorization (ROA) naming the provider's autonomous system number (ASN), such as 13335 for Cloudflare or 16509 for AWS.
- Sign a Letter of Authorization (LOA) and add an IRR route object, if required.
- The provider starts announcing the prefix over BGP.
An anycast CDN announces the prefix from every location, so visitors reach its nearest anycast network node.
Why Organizations Choose BYOIP Over Provider-Assigned IPs
Provider-assigned IPs change when you change providers. Owned addresses do not. Teams choose BYOIP to:
- Keep partner firewall allowlists working through migrations
- Point apex domains at stable A records, since a domain's apex cannot use a CNAME alongside its other records
- Control their own IP reputation
- Avoid re-IPing applications, VPNs and hardcoded clients
AWS also charges for public IPv4 addresses, but not for addresses brought through BYOIP.
BYOIP in a Multi-CDN Architecture
A multi-CDN strategy adds a constraint: a prefix should be announced by only one CDN at a time. Most providers reject a prefix another network already announces, and if two did, BGP would decide where visitors land, not you. The usual design splits a larger block into /24s, gives each CDN its own prefixes and uses DNS to steer users between them. Your DNS provider then controls failover, which matters: on February 20, 2026, a Cloudflare bug withdrew about 1,100 BYOIP prefixes for roughly six hours.
{{cool-component}}
The Security and Compliance Considerations of BYOIP
The main risk is a hijack, where another network announces your prefix to pull in your traffic. RPKI lets networks reject those, and NIST's RPKI monitor showed about 71% of IPv4 prefix-origin pairs as valid in October 2026. Keep ROAs minimal, since a loose maxLength lets an attacker announce a more specific route that still looks valid, as RFC 9319 warns. Alert on unexpected announcements of your prefixes, the first sign of BGP hijacking. For audits, record which provider may announce each prefix and review ROAs at every provider change.
Conclusion
BYOIP gives you addresses that outlast any single provider. Plan prefix sizes early, keep RPKI and IRR records accurate, split prefixes across CDNs and rehearse withdrawals before you need them.
FAQs
How Does BYOIP Differ From a CDN's Default IP Range?
A default range belongs to the CDN and is shared by many customers, so your IPs can change and you cannot take them with you. BYOIP addresses are registered to you and carry only your traffic, so they move with you between providers and allowlists built on them keep working.
Can BYOIP Be Used With DDoS Protection Services?
Yes, it is a common pairing. Cloudflare Magic Transit and Akamai Prolexic announce your prefixes, absorb attacks across their networks and forward clean traffic to your data centers. Azure DDoS Protection also covers addresses brought to Azure. Compare the main DDoS protection services before choosing one.
What Is RPKI and Why Does It Matter?
RPKI, the Resource Public Key Infrastructure, lets address holders publish signed ROAs stating which networks may announce their prefixes, and networks that enforce it drop other announcements. Most BYOIP providers require a valid ROA, and RPKI is the main defense against BGP hijacks of your addresses.
How Long Does Onboarding a BYOIP Prefix Typically Take?
It depends on the provider. AWS allows up to a week for EC2, though it often finishes in hours. Google Cloud quotes two to four weeks and Fastly 45 days or more. Cloudflare verifies ownership through its API in minutes, then needs several hours before announcing. Registry paperwork can add days.
What Happens to BYOIP Prefixes When Switching CDN Providers?
The prefixes stay yours. Add a ROA for the new provider's ASN and onboard the prefix there, then move the announcement in a planned window, with a short overlap if both providers allow it. Withdraw it from the old network and remove the old ROA once traffic has moved.
