JA EN
shiichan

Smart Tiered Cache Levels Up! Say Goodbye to Origin Hairpinning on Public Clouds!

Cloudflare Blog ★★★★ View Markdown
#cloudflare#infrastructure#devops

Hi everyone, it's Shiichan! Today I've got a story about Cloudflare's caching layer getting a little smarter. It might sound niche, but if you run origins on a public cloud, this update is a nice one!

Cloudflare Blog blog.cloudflare.com

What was announced?

This comes from a post on the Cloudflare Blog. It covers a new option added to Smart Tiered Cache that lets you hint the cloud region — AWS, GCP, Azure, or Oracle Cloud — where your origin actually lives. The post also goes deep into how the system works under the hood, so it's a satisfying read if you like architecture details.

The story so far

Smart Tiered Cache launched back in 2021. It automatically picks the best upper-tier data center for each origin based on real latency measurements, with the pitch being that flipping one switch finds the fastest path from Cloudflare's network to your origin.

The catch: origins on public clouds often sit behind anycast or regional unicast frontends, so a single origin IP can look equally close to multiple Cloudflare data centers at once. For example, an origin actually located in Singapore might show Chicago as the lowest-latency probe result.

When that happens, requests end up hairpinning — local data center to Chicago (upper tier) to Singapore (origin) and back through Chicago to the local data center — adding hundreds of milliseconds of unnecessary latency.

What changes

The new piece is a manually set cloud region hint for your origin. With it, Cloudflare can map even ambiguous, anycast-fronted origin IPs to their real region and choose a more accurate primary and fallback upper tier.

The result: less wasted latency from hairpinning, better cache consolidation (since traffic converges on the right upper tier), and fewer connections back to the origin. A small change with a real payoff.

Dive Deep

The clever way anycast gets detected

The post explains how anycast origins are detected in the first place. Cloudflare measures probe latency to the origin from multiple checkpoint data centers around the world. If the combined round-trip latency from two checkpoints is faster than what light in fiber could physically travel between those two points, the origin must be answering from more than one location. Using the speed of light itself as the tell is a pretty neat trick.

What a region hint looks like

Hints are specified in a format like this:

aws:us-east-1
gcp:europe-west1

Behind the scenes, Cloudflare fetches each cloud provider's IP range files every few hours and builds a mapping between regions and IP prefixes. That gets matched against an upper-tier database refreshed every 15 minutes from continuous latency probing. Matching subnets go through a weighted vote, and the upper tier with the strongest signal becomes the primary for that region.

For brand-new regions without much probe data yet, the system falls back to the geographically nearest Tier 1 PoP, then automatically switches to a data-driven choice once the origin comes online and probe data accumulates. Primary and fallback upper tiers are also chosen from different PoPs, so losing one PoP doesn't take both down at once.

Supported clouds and setup

Here are the supported providers, with more on the way:

  • AWS
  • Google Cloud Platform (GCP)
  • Microsoft Azure
  • Oracle Cloud

Setup from the dashboard is simple:

  • Go to Caching > Tiered Cache > Origin Configuration
  • Search for the origin IP
  • Click "Set Region Hint"
  • Choose the cloud region

Bulk editing across multiple origin IPs, as well as API and Terraform support, are also available, so it fits neatly into existing Infrastructure as Code workflows. One thing to note: dashboard-based hints can only be set for origins Cloudflare has already detected as anycast.

On pricing, Smart Tiered Cache itself is available to all plans for free.

How the feature has evolved

The post also recaps how Smart Tiered Cache has grown over time:

  • November 2024: Smart Tiered Cache for R2, auto-detecting R2 bucket locations
  • January 2025: Smart Tiered Cache for Load Balancing, sharing a cache across all origins in a pool
  • July 2026: this public cloud region hints feature

Wrap-up

  • Smart Tiered Cache now supports manual region hints for AWS, GCP, Azure, and Oracle Cloud origins
  • Even origins hidden behind anycast can now be mapped to the correct region, cutting wasted latency from hairpin routing
  • Under the hood, periodic IP range fetches and a 15-minute-refreshed upper-tier database feed a weighted vote that picks the primary and fallback upper tiers automatically
  • Configurable via dashboard, bulk edit, API, or Terraform, and free on all plans
  • A great update if you run origins on a public cloud and want to squeeze out latency and cache efficiency wherever you can!

Related posts