Anycast

Anycast is a network routing technique where a single IP address is advertised from many physical locations at once. When a client sends a packet to that IP, BGP routes the packet to whichever location is "closest" by network topology: usually the lowest-latency one.

Anycast in DNS

The big public resolvers all use anycast: 1.1.1.1 (Cloudflare), 8.8.8.8 (Google), 9.9.9.9 (Quad9), 208.67.222.222 (OpenDNS). When you set your DNS resolver to one of those IPs, your queries actually go to whichever data center is geographically nearest you, even though you're typing the same address.

Anycast at the authoritative tier

Authoritative DNS providers also use anycast. Cloudflare DNS, Route 53, NS1, and most modern providers run their nameservers as anycast networks: so a query to ns1.cloudflare.com from Sydney lands in Sydney, while the same query from Madrid lands in Madrid.

Worked example: why 1.1.1.1 feels fast everywhere

Cloudflare advertises 1.1.1.1 from over 300 cities. A user in São Paulo, a user in Tokyo, and a user in Helsinki all type 1.1.1.1 as their DNS server. The packet from São Paulo hits Cloudflare's São Paulo POP; Tokyo hits Tokyo; Helsinki hits Helsinki. None of them traverse a continent to reach the resolver. Single-digit-millisecond DNS, globally, from one IP literal.

Compare to a unicast resolver hosted in a single data center in Virginia. Helsinki users pay 100ms+ per query. Multiply by every DNS lookup a page load triggers and the difference is visible.

How to tell which POP you hit

Cloudflare exposes its POP location at https://1.1.1.1/cdn-cgi/trace — the colo= line is the airport code of the data center serving you. Google has a similar trick via dig TXT o-o.myaddr.l.google.com @8.8.8.8 +short, which returns the client subnet and resolver region.

Anycast vs GeoDNS

These solve different problems. Anycast gives every user the closest copy of the resolver; GeoDNS gives every user a different answer. They're often used together: an anycast nameserver serving GeoDNS-routed records.

Failure modes

BGP withdrawals can shift anycast traffic suddenly. If Cloudflare's London POP goes offline, every London user's 1.1.1.1 query reroutes to Amsterdam mid-session — usually invisible, but TCP connections in flight to the resolver may reset. Anycast is also why DDoS against a public resolver tends to localize: an attack from one country hits one country's POP, leaving the rest of the anycast cloud healthy.

Related: GeoDNS · resolver.