Learn
Cache-Control max-age vs s-maxage: Browser and CDN TTLs
Verdict, evaluated November 2026: set max-age for the browser and s-maxage for the CDN, and keep them deliberately ...
Akamai CDN Architecture Explained: Edge, Tiers and Mapping
Vadym Borovskyi
Akamai CDN architecture is built in three layers. A DNS-based mapping system picks an edge server for each resolver. Edge caches run in more than 4,000 locations across over 130 countries (Akamai's published figure as of 2024). A parent tier then collapses edge misses before they reach origin. Mapping answers on Akamai edge hostnames carry short TTLs, typically 20 seconds, so routing decisions refresh several times a minute. This article walks the request path layer by layer, describes the architecture diagram in text, works through the origin-load math of tiered distribution, and lists the failure modes worth instrumenting before your next renewal.
In Akamai's design as of 2026, the edge server handles caching, TLS termination, security rules and EdgeWorkers logic, while the parent tier exists mainly to protect origin. A popular object that would otherwise trigger up to 1,000 origin fetches per TTL across 1,000 edge clusters drops to roughly 10 with ten parent regions, which is arithmetic rather than a benchmark.
How Akamai CDN architecture routes a request
The request path has three hops worth reasoning about separately: name resolution, the edge server, and the path back to origin. Each hop has its own control surface in Property Manager and its own failure signature. Treating them as one "CDN" box is why many incident reviews stall at "Akamai was slow".
The mapping system: DNS as the load balancer
Your hostname CNAMEs to an Akamai edge hostname (an edgesuite.net or edgekey.net name), which resolves through Akamai's own authoritative name servers to an IP in the chosen edge cluster. Akamai's published design splits this into global load balancing, which picks a cluster per resolver, and local load balancing, which picks servers inside it using consistent hashing so the same object lands on the same machines. Inputs include measured latency, packet loss, cluster load, geography and BGP reachability. EDNS Client Subnet lets the mapper see the client's network instead of only the resolver's.
The trade-off is granularity. DNS mapping steers per resolver and per TTL, not per request. Anycast networks shift traffic at the routing layer instead, and they lose that per-resolver precision in exchange.
The edge tier: cache keys, Property Manager and EdgeWorkers
Edge servers serve hot objects from memory and flash. Property Manager rules decide what enters the cache key: path, selected query parameters, headers and cookies. That is where most cache-hit-ratio wins and most data leaks originate. EdgeWorkers runs JavaScript at the edge for request rewriting, A/B routing and lightweight personalization, with EdgeKV as a distributed key-value store. Both sit inside the per-request latency budget, so execution limits are part of capacity planning.
Midgress and origin: SureRoute, Site Shield and connection reuse
Traffic between edge and parent, or edge and origin, is midgress. For cacheable content it flows through the tiered distribution hierarchy. For dynamic content, SureRoute races candidate paths through intermediate Akamai nodes and picks the fastest overlay route, which helps most on long-haul paths with poor default BGP routing. Persistent, reused connections to origin remove repeated TCP and TLS handshakes. Site Shield restricts origin ingress to a published set of Akamai IP ranges, so origin firewalls accept only those.
Akamai CDN architecture diagram, described layer by layer
An Akamai CDN architecture diagram has a data plane and a control plane. The data plane runs from client to resolver, to Akamai's mapping DNS, to an edge cluster, to a parent tier, to an optional Site Shield-protected origin. The control plane pushes configuration, purges and certificates to every edge, and pulls logs and metrics back out.
- Client and recursive resolver: the resolver queries your CNAME, which points at an Akamai edge hostname.
- Mapping DNS: top-level and low-level Akamai name servers return edge IPs with short TTLs.
- Edge cluster: TLS termination, WAF and bot rules, EdgeWorkers, then a cache lookup on the computed key.
- Parent tier (tiered distribution): edge misses are forwarded to a parent region, which coalesces them.
- Origin layer: your origin, NetStorage, or a cloud bucket, optionally behind Site Shield or a dedicated cache layer such as Cloud Wrapper.
- Control plane: Property Manager activations, Fast Purge, certificate provisioning, log delivery and real-user monitoring feeding back to engineers.
Draw the control plane as a separate lane in your own diagram. Configuration activation and purge propagation fail independently of request delivery, and on-call engineers need to see that boundary.
How tiered distribution cuts origin load
Tiered distribution bounds origin fetches per object per TTL by the number of parent regions instead of the number of edge clusters. The worked model below uses stated assumptions; replace them with your own numbers.
Assume a popular object with a 60-second TTL is requested from 1,000 edge clusters each minute. Without a parent tier, each cluster misses once per TTL, so origin sees up to 1,000 fetches per minute for that one object. With ten parent regions, edge misses converge on parents and origin sees at most 10, a 99 percent reduction for that object. A single-parent design, such as a dedicated cache layer next to a cloud origin, reduces it to roughly 1.
The long tail behaves differently. An object requested twice an hour gets almost no help from tiering, because the parent copy expires before the second request arrives. Offload is therefore bimodal. Head content approaches full offload, while the tail is set by TTL length and parent cache capacity.
The cost side is plain arithmetic. At 100 TB delivered a month, 95 percent byte offload leaves 5 TB of origin egress, and 99 percent leaves 1 TB. At an estimated $0.05 to $0.09 per GB for cloud egress (typical public-cloud list ranges, an estimate), that is $250 to $450 versus $50 to $90 a month. The bigger win is usually origin compute and storage IOPS, not egress. Measure offload in both bytes and requests: small API responses can drag request offload down while byte offload looks excellent.
Security layers and recent platform changes
What Akamai architecture includes beyond the CDN
Akamai architecture extends past caching into security and compute. App and API Protector (WAF), Bot Manager and edge DDoS absorption run on the same edge servers as delivery. Prolexic provides dedicated DDoS scrubbing for whole networks, and Guardicore Segmentation covers internal zero-trust controls. Akamai Connected Cloud adds general-purpose compute regions.
Running security inline at the edge means attack traffic is rejected before it consumes midgress or origin capacity. The cost is coupling: a rule change in a security configuration can alter cache behavior or latency, so security and delivery changes belong in the same change review. Connected Cloud grew out of the 2022 Linode acquisition and lets teams place backends and origins closer to Akamai's delivery footprint. Image and Video Manager selects formats such as AVIF or WebP per device at the edge, which shifts transformation work off origin. Akamai also supports HTTP/3 on its edge for clients that negotiate it.
Failure modes: what breaks and how to confirm it
| Failure | How it shows up | How to confirm |
|---|---|---|
| DNS mapping staleness | One ISP or region sees elevated TTFB while others are clean | Resolve the edge hostname through the affected resolver and compare answers and remaining TTL; resolvers that clamp TTLs upward extend the bad mapping |
| Cache-key or Vary error | Personalized content served to the wrong user, or hit ratio collapses after a release | Inspect X-Cache-Key on two sessions; identical keys on personalized responses mean a leak |
| EdgeWorkers limit exhaustion | Error spikes only during traffic peaks | Correlate EdgeWorkers error and timeout reports with request rate |
| Site Shield map change | Origin connection failures from a subset of parents | Diff current Site Shield ranges against the origin allowlist; automate acknowledgment of map updates |
| Parent tier far from origin | Good hit ratio but slow cache misses | Compare miss TTFB against parent-to-origin round-trip time |
| Activation lag | Mixed old and new behavior for several minutes after a change | Check the activation status in Property Manager before declaring a fix failed |
Most Akamai incidents that look like network problems trace back to configuration: cache keys, allowlists or activation timing.
Verify this on your own Akamai property
Send a request with the Pragma header set to akamai-x-cache-on, akamai-x-cache-remote-on, akamai-x-check-cacheable and akamai-x-get-cache-key. X-Cache shows TCP_HIT or TCP_MISS at the edge, and X-Cache-Remote shows the parent tier outcome. X-Check-Cacheable states whether the object can be cached at all, and X-Cache-Key exposes the key that actually applied. A miss at the edge paired with a hit at the parent means tiering is working and edge capacity or TTL is the lever.
When the Akamai CDN fits, and when it does not
| Workload | Fit | Why |
|---|---|---|
| Global live streaming and premium VOD | Strong | Footprint depth and tiered distribution absorb audience spikes |
| Conversion-sensitive e-commerce | Strong | Inline WAF, bot management and SureRoute on one edge |
| API-heavy SaaS | Moderate | Security value is high, cache offload is low |
| Large game builds and software downloads | Moderate to weak | Bulk bytes, little need for edge logic, cost per TB dominates |
| Cost-sensitive traffic under about 100 TB a month | Often weak | Contract minimums and quote-based pricing outweigh the feature depth |
Akamai earns its premium where security, live events and dynamic routing matter, and loses it on bulk static bytes.
Akamai publishes no CDN price list, so the only honest comparison is your contracted spend divided by delivered TB. If part of your traffic lands in the weak rows, BlazingCDN, a pay-as-you-go delivery CDN for video, software and large files, can carry that slice as a second CDN behind DNS with a weighted split while Akamai keeps the security stack; see the BlazingCDN vs Akamai comparison for bulk delivery. The trade-off is real: BlazingCDN does not support HTTP/3 and sells no WAF.
FAQ: Akamai CDN architecture
How does the Akamai CDN choose which edge server serves a user?
The Akamai CDN chooses edge servers through its DNS-based mapping system. Authoritative Akamai name servers return edge IPs based on measured latency, packet loss, cluster load and BGP reachability for the requesting resolver, refined by EDNS Client Subnet where available. Answers carry short TTLs, typically 20 seconds, so mapping adapts quickly, but only per resolver rather than per request.
What does an Akamai CDN architecture diagram include?
An Akamai CDN architecture diagram includes a data plane and a control plane. The data plane runs from client and resolver to mapping DNS, edge cluster, parent tier and origin, optionally behind Site Shield. The control plane covers Property Manager activations, Fast Purge, certificates and log delivery. Drawing them as separate lanes makes configuration-driven incidents easier to isolate during on-call.
Does Akamai tiered distribution always improve origin offload?
Akamai tiered distribution improves origin offload mainly for popular content. It bounds origin fetches per object per TTL by the number of parent regions instead of edge clusters, so a hot object can drop from about 1,000 fetches to about 10. Rarely requested long-tail objects gain little, because parent copies expire before a second request arrives.
What is the difference between Akamai architecture and Akamai CDN?
Akamai CDN refers to content delivery: mapping, edge caching, tiered distribution and origin connectivity. Akamai architecture is broader and includes App and API Protector, Bot Manager, Prolexic scrubbing, Guardicore segmentation and Akamai Connected Cloud compute. Many workloads buy the security layers and use delivery lightly, so contract reviews should price each layer against its actual usage.
How do I check whether Akamai served a response from cache?
Send the Akamai Pragma debug values akamai-x-cache-on and akamai-x-cache-remote-on with a request. The X-Cache response header shows TCP_HIT or TCP_MISS at the edge, and X-Cache-Remote shows the parent tier result. Adding akamai-x-get-cache-key exposes the applied cache key, which is the fastest way to spot cache-key mistakes.
Measure your Akamai offload, then test a split
This week, pull origin offload by content type in both bytes and requests, p95 and p99 time to first byte on cache misses, EdgeWorkers error rates at peak, and contracted spend divided by delivered TB. Then sort your traffic into the fit table above. If more than a third of your bytes are bulk static files with no edge logic or WAF dependency, a weighted DNS split is worth a controlled test before renewal.
BlazingCDN offers a 14-day testing period on real production traffic, and its multi-CDN integration guide for running beside Akamai covers the weighted DNS setup for that split.
Heavy traffic.
Light bill.
The CDN for video and large traffic
