Upgrading the Cloudflare China Network: better performance and security through product innovation and partnership

China Network refresh: DNS, DDoS, and performance upgrades

Cloudflare has served customers in mainland China since 2015, but a recent expansion through a partnership with JD Cloud has brought substantial changes to how its services operate in the country. The new Cloudflare China Network, built on JD Cloud infrastructure, has been live for several months now, according to the company. The network introduces improvements to DNS resolution, DDoS mitigation, and overall performance that the company says represent a significant step up from the previous in-country deployment. Customers licensed to operate in China can enable the new network via the Cloudflare dashboard or API.

Serving DNS from within China

Cloudflare operates one of the largest DNS platforms in the world, answering roughly 12 million queries per second on average in Q2 2021 from more than 200 cities across over 100 countries. But for users in mainland China, the old network had a problem: queries had to leave the country, often crossing the Pacific Ocean to reach nameservers outside China. That added latency and, in some cases, packet loss.

The new setup serves DNS directly from JD Cloud Points of Presence (PoPs) inside China. When a customer opts in, Cloudflare assigns two nameservers from a select set of domains:

cf-ns.com
cf-ns.net
cf-ns.tech

The choice of Top Level Domains (TLDs) is deliberate. The selected TLDs are different from the TLD of the domain using them, which allows for "glueless delegations." Instead of relying on static glue records—mappings that registrars add to break circular DNS lookups when a domain uses its own domain as its nameserver—Cloudflare can return nameserver IP addresses dynamically. That means queries are always answered from the nearest PoP, and traffic can be spread across multiple PoPs to distribute load and mitigate attacks more effectively.

DDoS mitigation without anycast

Outside China, Cloudflare uses anycast routing to absorb DDoS attacks at data centers close to the traffic source. Inside China, that approach is not viable. Core Internet access is largely controlled by China Telecom, China Unicom, and China Mobile, and those ISPs control IP allocation and routing. Chinese Internet giants themselves rarely own their IP allocations or use BGP for routing, which makes anycast-based techniques largely impossible.

The JD Cloud expansion required a different strategy. Cloudflare pushed its edge-based mitigation system to handle detection and response for application-layer (L7) attacks locally, reducing the time to mitigate and removing dependence on central coordination. In Q1 2021, 81% of all L7 attacks were mitigated at the edge. For larger network-layer (L3/L4) attacks, Cloudflare worked with JD Cloud to integrate remote signaling with China Telecom, China Unicom, and China Mobile, allowing automatic requests for upstream filtering. In the same quarter, 98.6% of L3/L4 attacks were mitigated without any centralized communication. Attacks above certain thresholds can be rerouted to large scrubbing centers—a technique that is unnecessary in an anycast environment but practical where unicast is the only option.

Cloudflare also developed traffic engineering processes to shift traffic away from overloaded data centers toward locations with spare capacity. While similar controls already existed outside China, applying them domestically required integration with the DNS systems.

Because all Cloudflare data centers run the same software stack, improvements made to DDoS detection and mitigation for the China network have also propagated back to data centers elsewhere.

Performance gains measured

To benchmark the new network against the previous in-country one, Cloudflare deployed a test zone on both and compared the results using two common public cloud origins, one in the northwestern United States and one in Western Europe. Both zones used China-based DNS nameservers. A benchmarking service with clients across various Chinese cities and provinces downloaded 100 KB, 1 MB, and 10 MB files every 15 minutes over a 36-hour period.

Round Trip Time (RTT) from clients to the JD Cloud PoPs was reduced by at least 30% across all file sizes. That latency reduction translated directly into faster Time to First Byte (TTFB), which the company notes is especially significant because latency and the TCP slow-start process are typically the bottleneck for most connections. Consistency also improved, with less variation in latency.

Cloudflare attributes the improvement to the quality of the JD Cloud network, the placement of PoPs within China, and the ability to direct clients to the closest PoP. As more capacity and PoPs are added, the company expects further latency improvements.

What changed for DNS and content delivery

Testing has also covered dynamic and static content scenarios, as well as DNS resolution itself.

Availability and outlook

The Cloudflare China Network is now open to customers licensed to operate in China. Cloudflare says the combination of DNS innovations, edge-based DDoS mitigation, and improved network distribution has yielded at least a 30% performance improvement over the 2015-era in-country network. More details are available through Cloudflare’s China Network page.