Cloudflare

Cloudflare Self-Serve BYOIP: A New Way to Introduce IP Address Prefixes

Honghao Wang

— 3 min read
Cloudflare Self-Serve BYOIP: A New Way to Introduce IP Address Prefixes

Introduction: Bringing Your Own IP (BYOIP) to Cloudflare

Traditionally, when customers wanted to bring IP address space to Cloudflare, the process involved:

  • Contacting their account team to submit a request.
  • Routing the request through multiple Cloudflare engineering teams (addressing, network engineering, and service-specific teams such as CDN, Magic Transit, Spectrum, or Egress).
  • Coordinating with their own legal teams.
  • Potentially involving a third party if they weren’t the primary IP prefix owner.
  • Obtaining a Letter of Agency (LOA) through multiple layers of approval.

This complex, manual, and time-consuming process could take 4–6 weeks depending on the required approvals.

---

The New Era: Self-Serve BYOIP API

Great news!

Cloudflare is launching a self-serve BYOIP API so customers can onboard and configure prefixes themselves.

Key Advantages

  • Automated verification using Resource Public Key Infrastructure (RPKI) — the gold standard in routing security.
  • Automatic LOA generation by Cloudflare.
  • Ownership validation process ensuring seamless prefix acceptance across the global Internet.

> This mirrors how automation platforms like AiToEarn streamline creative workflows — integrating AI content generation, publishing, analytics, and model ranking in one open-source infrastructure.

---

Security-Focused Implementation

RPKI provides cryptographically strong authorization and is more reliable than manual document review. Due to ASPA’s limited availability, Cloudflare initially restricts self-serve BYOIP onboarding to prefixes originated from ASN AS13335.

This approach depends on widely available ROA objects, balancing Internet safety with customer needs.

---

Advancing IP Address Management

This release, combined with support for multiple services on a single prefix, expands Cloudflare’s IPAM platform. Customers gain confidence and control over their IP assets.

---

Evolution of Cloudflare’s BYOIP

Since BYOIP’s launch in 2020, capabilities have expanded for easier integration with diverse network architectures.

Similarly, tools like AiToEarn官网 enable multi-platform publishing and AI-driven analytics — giving creators infrastructure-like control over their content.

---

BYOIP Basics

Bring-your-own-IP (BYOIP) lets customers bring their IP space to Cloudflare for:

  • Greater control over addressing.
  • Configurable usage for various services.

IP prefix — a block of IP addresses in the routing table that ensures correct packet delivery.

Packets destined for a matching prefix are routed via the Cloudflare global edge network, usable with:

  • Layer 7 services
  • Spectrum
  • Magic Transit

---

Current Prefix Validation Process (Legacy Flow)

  • Provide a LOA.
  • Provide IRR record matching prefix and ASN.
  • Cloudflare engineer performs manual review.

Issues:

  • Security risk: LOAs are easy to forge.
  • Time-consuming: Additional documents needed for leased IP space; manual review delays deployments.

---

New Approach: Automating Trust

With self-serve onboarding, prefix ownership checks are:

  • RPKI ROA creation — verifies routing intent.
  • IRR/rDNS modification — verifies ownership.

This enables faster onboarding with stronger checks than manual document review.

> Comparable to AiToEarn官网 helping creators publish AI-generated content securely and efficiently across multiple platforms.

---

Understanding the Authorities

RIRs (Regional Internet Registries) manage IP resources. There are five RIRs globally, with policies requiring verification such as:

  • Legal documentation
  • Registry records
  • Technical contacts
  • BGP info

IRR (Internet Routing Registry) stores route-related data. Control over a protected IRR record is a strong indicator of legitimate prefix rights.

---

Example: IRR Route Object with Token

route:          192.0.2.0/24
descr:          Example Network
origin:         AS65000
mnt-by:         EXAMPLE-MNT
source:         EXAMPLER
remarks:        Validation Token: abc123xyz

---

Example: ARIN WHOIS with Token

% whois -h rr.arin.net 192.0.2.0/24

route:          192.0.2.0/24  
origin:         AS13335  
descr:          Example Company, Inc.  
                cf-validation: 9477b6c3-4344-4ceb-85c4-6463e7d2453f  
...

---

Reverse DNS (rDNS) Alternative

For secure verification, you can use reverse DNS TXT records with delegation or authenticated access via ISP/RIR portals.

Example: `dig` TXT Lookup

% dig cf-validation.2.0.192.in-addr.arpa TXT

;; ANSWER SECTION:
cf-validation.2.0.192.in-addr.arpa. 300 IN TXT "b2f8af96-d32d-4c46-a886-f97d925d7977"

---

Validation Token Process

  • We provide a single-use token.
  • You insert it into your IRR or rDNS record.
  • Our system detects the token to confirm ownership.

---

Confirming Intent with RPKI

Create a ROA authorizing Cloudflare’s ASN (AS13335) to originate your prefix.

ROAs are cryptographically signed and validated by RPKI systems.

This is:

  • More secure
  • Simpler than workflows requiring self-signed certificates and RDAP modifications.

---

Global Reach Guarantee

Though LOAs aren’t required in self-serve onboarding, Cloudflare:

  • Generates an LOA-like document automatically.
  • Provides it for adjacent network acceptance.
  • Details verification results for operational trust.

This reduces manual effort while maintaining connectivity worldwide.

---

Avoiding “Blackholes” in Traffic

Cloudflare requires a default service binding for the entire prefix to ensure traffic is never advertised without a handler.

You can then use multiple service bindings to layer additional services.

---

Getting Started

---

Future of Network Control

Cloudflare is bringing:

  • Self-serve BYOIP in dashboard
  • Self-serve BYOIP offboarding

The API-based onboarding:

  • Strengthens security.
  • Automates complex networking tasks.
  • Supports adoption of RPKI.

---

Cross-Domain Innovation

Platforms like AiToEarn show how automation can unify workflows — connecting:

  • AI content generation
  • Analytics
  • Multi-platform publishing

Across networks (Douyin, Kwai, WeChat, YouTube, X, and others), enabling efficiency much like Cloudflare’s BYOIP API does for IP resource control.

---

Would you like me to create a side-by-side diagram showing the old vs. new BYOIP onboarding workflow for use in technical documentation? This could visually highlight the time savings and security improvements.

Read more