CDN Checker

Detect which CDN (Cloudflare, Akamai, Fastly, and more) serves a site, from its DNS and response headers.

Result

No result yet

Enter the inputs above and press Run. Results appear here in a moment.

Monitor this 24/7 — get alerts on the first failure.

Only run these tools against systems you own or are authorized to test. Using them to scan or probe systems without permission violates our Terms.

What is CDN Checker?

A CDN sits between your origin server and the rest of the internet — caching content at the edge, terminating TLS, absorbing traffic spikes, and (often) shielding your origin's real IP. Most of the time you never think about it, until the day a cache won't purge, a region serves stale content, or a security scan asks "is this site behind Cloudflare?" and you realise you're not actually sure.

This tool tells you which CDN, if any, is fronting a domain — Cloudflare, Akamai, Fastly, Amazon CloudFront, Google, Bunny, and others — by reading the same public signals a browser sees: the DNS chain (CNAME and nameserver fingerprints) and the HTTP response headers (CF-Ray, X-Served-By, Via, X-Amz-Cf-Id, Server, and friends). No login, no agent on the server — just what the network reveals.

How it works

Detection is a fingerprint match across two layers:

1Resolve the domain — Confirm it resolves at all, then inspect the DNS chain — a CNAME to *.cloudflare.net, *.akamaiedge.net, *.fastly.net, or *.cloudfront.net is a strong tell, as are the authoritative nameservers.
2Fetch the site over HTTPS — Issue a normal request and read the response headers. Each CDN leaves a signature: Cloudflare's CF-Ray and Server: cloudflare, Fastly's X-Served-By / Via, CloudFront's X-Amz-Cf-Id and Via: ... CloudFront, Akamai's X-Akamai-*, and so on.
3Match against known providers — We weigh the DNS and header evidence together and report the most likely provider — or None when nothing matches a recognised edge network.

None doesn't always mean "no CDN" — it can mean the origin is served directly, or that a CDN is configured to hide its signatures, or that it's an edge network we don't fingerprint yet. It does reliably tell you that the common, header-leaking providers aren't in front of this hostname.

When you'd use it

Confirm your CDN is actually serving traffic

You enabled Cloudflare's proxy (orange cloud) weeks ago — but is the apex still pointed at it, or did a DNS change quietly bypass it? Check the hostname and confirm the provider you expect is the one answering.

Cache / purge debugging

Stale content won't go away after a deploy. Step one is knowing whose cache you're fighting — the purge API, the cache-control rules, and the X-Cache: HIT/MISS header all differ per provider. Identify the CDN before you start guessing.

Origin-exposure audit

A CDN only protects your origin if the origin IP isn't reachable directly. Detecting the CDN is the first step; the dangerous follow-up is whether the bare origin still answers on its own IP (a common DDoS-bypass hole).

Migration verification

Moving from CloudFront to Fastly, or onto a CDN for the first time. Run the check before and after the cutover to confirm the edge actually changed and you're not still half-served by the old provider during propagation.

Competitive / vendor recon

Quickly see what infrastructure a site runs on — useful when sizing a migration, evaluating a vendor's claims, or understanding why a competitor's site feels faster.

Reading the result

Provider

The detected edge network (e.g. Cloudflare, Fastly, Amazon CloudFront). This is the network terminating the connection for the hostname you checked — not necessarily the company that owns the origin behind it.

Detected (yes / no)

Yes means at least one strong CDN signature matched. No means the request resolved and responded, but nothing matched a known provider — most often a directly-served origin, or a CDN running in a transparent / signature-stripped mode.

Check time

How long the detection round-trip took. Slow times here usually reflect a slow origin or a distant edge POP, not the detection itself.

Common pitfalls

The apex and the asset subdomain differ

Plenty of sites serve HTML straight from the origin but push static.example.com or cdn.example.com through a CDN. Checking example.com tells you about the apex only — check the asset hostname separately if that's what you care about.

Cloudflare in "DNS-only" (grey cloud) mode

If a record is grey-clouded, Cloudflare is only doing DNS — not proxying — so none of the proxy headers appear and the site is effectively served direct. That's a configuration choice, not a detection failure.

Multi-CDN setups

Large sites split traffic across two or more CDNs (for redundancy or cost). A single check sees whichever provider answered this request; run it a few times, or from different tools, if you suspect more than one.

Header stripping

Some providers can be configured to suppress their identifying headers. Detection then leans entirely on the DNS chain — and if that's also obscured (apex flattening, custom CNAMEs), the honest answer is None, even though an edge is technically present.

Run CDN Checker on every change, not just once.

Get alerts the moment something breaks — across HTTP, DNS, SSL, RDAP, ping, blacklist and more. Free forever for 10 monitors. No card.

Start free

Frequently asked questions

How does it know which CDN is being used?

It combines two public signals: the DNS chain (CNAME targets and nameservers — e.g. a CNAME to *.fastly.net) and the HTTP response headers each CDN adds (CF-Ray for Cloudflare, X-Amz-Cf-Id for CloudFront, X-Served-By for Fastly, and so on). No access to the server is needed.

Why does it say "None" when I know the site uses a CDN?

Three common reasons: the CDN is in a transparent/DNS-only mode (e.g. Cloudflare grey cloud) so it adds no proxy headers; the CDN fronts a different hostname than the one you checked (often static. or assets.); or it's an edge network whose fingerprints we don't recognise yet. The site still resolved and responded — it just didn't match a known signature.

Does it check the whole site or just one URL?

It checks the hostname you give it — the apex or whatever subdomain you enter. CDNs are configured per-hostname, so if your HTML and your assets live on different hostnames, check each one.

Can it detect a WAF or DDoS-protection service?

Indirectly — most WAF/DDoS services (Cloudflare, Akamai, Imperva) are also CDNs and share the same fingerprints, so they'll show up as the provider. It won't tell you which security features are enabled, only which edge network is in front.

Is detecting a CDN a security risk for my site?

No — the CDN identity is public by design (it's in your DNS and your response headers). The real risk is the opposite: if your origin server still answers on its own IP, attackers can bypass the CDN entirely. Detecting the CDN is the prompt to go verify your origin is locked down.

Why might the provider change between checks?

Multi-CDN traffic splitting, or DNS round-robin across providers, can route consecutive requests to different edges. If you see it flip, the site is almost certainly running more than one CDN.