Improving Smart Tiered Cache for Public Cloud Regions

Anycast origins and the tiered cache problem

Smart Tiered Cache, Cloudflare's most popular tiered cache topology, works by measuring latency from each Cloudflare data center to an origin IP and selecting the single best upper-tier data center to route cache misses through. That single point of concentration yields higher cache hit ratios, fewer origin connections, and lower latency on origin pulls — but only when the origin has a fixed, unicast IP address.

Public cloud origins usually don't. Cloud providers like AWS, GCP, Azure, and Oracle Cloud sit behind anycast or regional unicast front ends, where one origin IP can appear equally close to many Cloudflare data centers simultaneously. Probes have nothing to lock onto: different Cloudflare data centers may reach different nearby cloud edges for the same IP, with the provider carrying requests across its own network to the actual backend. When there's no clear winner, Smart Tiered Cache falls back to multiple upper tiers. Nothing breaks, but cache efficiency drops.

The failure mode can be dramatic. An origin in Singapore behind an anycast IP might show the lowest probe latency from Chicago. Smart Tiered Cache would select Chicago as the upper tier, routing a request from an Asian end user across the continent to Chicago, which then fetches from Singapore — crossing the ocean twice. This hairpinning adds hundreds of milliseconds of latency and is one of the most consistently reported issues from customers with cloud-hosted origins.

Detecting anycast from physics

Cloudflare's system can already detect anycast origins using a constraint from physics: the speed of light. Probe latencies are measured from multiple checkpoint data centers around the world. If the combined latencies from two checkpoints are faster than light in fiber could physically travel between them, the origin must be answering from multiple locations — meaning it's anycast.

When Smart Tiered Cache detects an anycast origin, it plays it safe and won't pin that IP to a single upper tier. Instead, it falls back to a tiered cache topology with multiple upper tiers. Tiered caching still works, but spreading traffic across multiple tiers instead of one means more requests reach the origin.

Smart Tiered Cache for Public Cloud Regions closes this gap by letting you provide a cloud region hint. With that hint, Cloudflare can map public cloud origins to the right region and select better primary and fallback upper tiers, even when the origin IP looks anycast or ambiguous.

Setting a region hint

From the Cloudflare dashboard, go to Caching > Tiered Cache > Origin Configuration. Find your origin IP, click "Set Region Hint," and tell us the cloud region (for example, aws:us-east-1 or gcp:europe-west1). On the dashboard, region hints can only be set for origins whose IPs have been detected as anycast.

Hints can be set one IP at a time or bulk-edited across all origin IPs at once. The same configuration is available via the API and through Terraform for infrastructure-as-code workflows. The launch covers AWS, GCP, Azure, and Oracle Cloud, with more providers coming.

How the region mapping works

Every few hours, Cloudflare fetches the latest IP range files from each supported cloud provider. These files map every cloud region to its current set of IP prefixes, so subnet additions, removals, and reassignments are picked up automatically.

Those subnets are matched against an upper tier database built from continuous latency probing refreshed every 15 minutes. For each cloud region, each matching subnet contributes a weighted vote based on its current upper-tier assignment. The upper tier with the strongest signal becomes the region's primary upper tier. Primary and fallback always come from different points of presence (PoPs), so losing one PoP can't take out both.

Regions without enough probe data — for example, a new cloud region still rolling out or one with no origin onboarded to Cloudflare yet — fall back to geography: the closest Tier 1 PoP. As origins come online and probe data builds up, the region quietly switches from that geographic guess to the data-backed option.

This work builds on earlier Smart Tiered Cache extensions. In November 2024, Smart Tiered Cache for R2 taught the system to automatically select the closest upper tier to where an R2 bucket actually lives. In January 2025, Smart Tiered Cache for Load Balancing extended the system to select a single optimal upper tier for an entire Load Balancing pool, so all origins in the pool share the same cache, improving hit ratios.

What the customer does now

The constant probing, the algorithmic choice of each region's best upper tier, the geographic fallbacks, and the failover across PoPs all run on Cloudflare's side. The customer's only job is selecting the region hint.

For anycast origins on public clouds, the feature is available now in the dashboard under Caching > Tiered Cache > Origin Configuration. Cloudflare plans to expand to more providers and continue teaching Smart Tiered Cache to recognize more origin setups and pick the right path on its own.