What is Anycast?

02Unicast, anycast, multicast and broadcast

Anycast is one of four ways an address can map to receivers. IPv6 defines anycast addresses explicitly and drops broadcast altogether: RFC 4291 states that 'there are no broadcast addresses in IPv6', their job being done by multicast.

03What it gives you

• Lower latency, because a nearby location answers without any DNS trickery
• Automatic failover: if a location goes offline its announcement disappears and traffic reroutes
• Attack division: a distributed attack is split across locations by the same routing that splits real traffic
• One address to manage rather than a different hostname per region
• Proven at the largest scale: root-servers.org listed more than 2,000 instances behind the 13 root server names in October 2026, run by 12 independent organisations

04Why it matters for DDoS protection

A botnet attacking an anycast address does not get to choose where its traffic lands. Each bot is routed to whichever location its network prefers, so an attack from machines spread across the world is spread across the network in roughly the same proportion. The same holds for amplification attacks, whose reflected traffic enters the network near the reflectors rather than near the victim.

This turns a single-point problem into a shared one. RFC 4786, the operational best practice for anycast, notes that a node 'can act as a sink for attack traffic originated within its sphere of influence'. An attack that would saturate one datacentre may be entirely comfortable when divided across many, and it happens without a detection step or a failover to trigger.

The division is only as even as the catchments, though. A botnet concentrated in one region lands mostly on the sites that serve that region, and RFC 7094 warns that withdrawing an overloaded site's route simply moves the attack to another instance, potentially causing a cascaded failure.

05How to see anycast in action

Anycast DNS servers will tell you which instance answered. A CHAOS-class TXT query for hostname.bind or id.server (RFC 4892), or the NSID option (RFC 5001), returns an instance name. Run the same command from two networks and the names differ, although the address is identical; for K-root, run by the RIPE NCC, the name contains a site code.

Path tools show the same thing from the routing side. A traceroute to the same address from two vantage points ends in different places, often with short round-trip times from both. The guide to reading a traceroute and MTR explains each hop, and an IP and ASN lookup confirms that the announcing network is the same wherever you stand.

# Which K-root instance answers you? (CHAOS-class TXT, RFC 4892)
dig +short @k.root-servers.net hostname.bind CH TXT

# The same question through the EDNS NSID option (RFC 5001)
dig +nsid +norec @k.root-servers.net . SOA

# Where does the path end from here? Repeat from another network and compare
traceroute -n -q 1 -w 2 193.0.14.129

06The trade-offs

Anycast is a poor fit for long-lived stateful connections. Routing can change mid-session: a BGP update moves you to a different location that has no record of your connection, and as RFC 7094 puts it, the session will be reset. This is why anycast is common for DNS, HTTP and TLS, which are short and reconnect cleanly, and rare for long-running sessions unless state is shared between sites.

It also needs your own address space and BGP sessions at every site. IPv4 prefixes longer than a /24 and IPv6 prefixes longer than a /48 are 'generally neither announced nor accepted' (RFC 7454), so even a small anycast service needs at least a /24, the smallest IPv4 block the internet routes, which is why anycast is something you buy from a provider rather than build for a single service.

Because the same prefix is legitimately announced from many places, origin validation matters. Publishing RPKI route origin authorisations for the prefix lets networks that validate routes reject announcements from any other origin, which narrows the room for hijacks and leaks.

07When anycast is the right tool

Where anycast does not fit, protection usually comes from routing traffic through a filtering network that delivers only the clean part to a unicast address, the approach described in the guide to remote DDoS protection.