BYOIP reaches general availability
Cloudflare has announced general availability of Bring Your Own IP (BYOIP) across its Layer 7 products, Spectrum, and Magic Transit. The feature, previously API-only, now has UI support for prefix management and is documented on the relevant product pages and developer docs.
BYOIP lets customers have Cloudflare announce their own IP prefixes from the edge. An IP prefix is a range of addresses; routers build routing tables from announced prefixes to deliver packets. With BYOIP, Cloudflare advertises a customer’s prefix from more than 200 cities and ties it to the chosen Cloudflare services. The customer’s IP space gets the same protection and acceleration as Cloudflare’s own IPs.
Customers typically choose BYOIP because their prefixes are already allow-listed in important third-party systems, making it impractical to update firewall rules for Cloudflare address space. Similarly, large user bases may have DNS records pointing directly at the customer’s IPs; migrating them to Cloudflare’s IPs would be costly and slow.
Cloudflare has onboarded hundreds of customer prefixes so far: 84% for Magic Transit, 14% for Layer 7, and 2% for Spectrum. BYOIP also supports regional deployments for customers with data sovereignty or other constraints on where prefixes may be announced.
Prefix advertisement can be enabled from the UI or API, with changes taking effect across the edge in minutes. All BYOIP customers get network analytics on their prefixes, and every IP in a BYOIP prefix behaves as a static IP.
Service-specific considerations
Layer 7
Layer 7 BYOIP supports a range of IP-to-domain mappings, including shared IPs across domains and dedicated IPs for specific domains. Dedicated IPs help meet requirements like non-SNI support. For SSL for SaaS customers, BYOIP adds flexibility to change IP responses for custom_hostnames if an IP becomes unserviceable.
Spectrum
The Spectrum API supports BYOIP, allowing customers to associate specific IPs from their prefix with a Spectrum application. Spectrum handles any UDP or TCP protocol.
Magic Transit
Magic Transit, a Layer 3 security service, requires BYOIP: Cloudflare must announce the customer’s IPs to attract traffic to the edge for filtering and firewall processing. Magic Transit supports sophisticated packet filtering and firewall configurations.
Prerequisites and validation
Before Cloudflare can announce a prefix, customers must provide a Letter of Authorization (LOA) detailing the prefix and how it should be announced. Cloudflare shares the LOA with its Tier 1 transit providers so they are aware of the authorization.
Internet Routing Registry (IRR) records must also be up to date and match the LOA data. This typically means updating the entry in the appropriate regional registry (ARIN, RIPE, APNIC). Customers are encouraged to use RPKI; Cloudflare supports it for customer prefixes.
Configuration and delegations
Once the account team confirms a prefix is ready, the customer can control advertisement with the ‘dynamic advertisement’ toggle in UI or API. Toggling causes the edge to announce or withdraw the prefix.
Delegations control how a prefix may be used across multiple Cloudflare accounts. A prefix is owned by one account, but a delegation can extend functionality to other accounts. Delegations apply to Layer 7 and Spectrum BYOIP prefixes.
For Layer 7 + SSL for SaaS, delegating a prefix to another account lets that account use the prefix to validate custom hostnames. All IPs can serve custom hostname traffic, making it easy to swap IPs if one is blocked.
For Spectrum, a delegation lets the second account choose IPs from the prefix when creating Spectrum applications via the API.
