How anycast DNS works: one IP, many locations
An anycast address is a single IP that dozens of servers in different cities all claim at once, and the network quietly sends each user to whichever one is closest. The user queries 1.1.1.1 from Tokyo and from Frankfurt, and each reaches a different physical machine, yet neither ever learns there was a choice. This is the backbone of every fast public DNS resolver and most authoritative DNS today.
Unicast, the normal case
In ordinary unicast routing, one IP maps to one host. A route to 203.0.113.10 points at exactly one machine in one data center. Every packet for that address converges on that single location, however far away the sender sits. For a service in Virginia, a user in Singapore pays the full round trip across the Pacific on every query. DNS lookups are small and frequent, so that latency is felt directly.
What anycast changes
Anycast keeps the same destination IP but advertises it from many places. Each site runs the same service, holds the same data, and announces the same prefix into the global routing table using BGP. The internet's routers then treat the address like any other destination and pick the path with the lowest cost. Because many sites announce it, "lowest cost" usually means "nearest," so a query lands at a nearby node without the client doing anything special.
| Property | Unicast | Anycast |
|---|---|---|
| IPs per service | one IP, one host | one IP, many hosts |
| User reaches | the single origin | the nearest node |
| Routing mechanism | normal BGP | same prefix announced from many sites |
| Failure of one site | service down for all | traffic reroutes to other sites |
How BGP picks a node
BGP is the protocol that decides how traffic moves between networks. Each site announces the anycast prefix to its upstream providers, and those announcements propagate outward. A router comparing several paths to the same prefix applies its usual selection rules: shortest AS path, local preference, and so on. The result is that a router forwards toward the topologically closest announcement, which correlates with geographic closeness but is not guaranteed to match it. Routing follows network topology and peering agreements, not a map.
Why it resists DDoS
A denial of service flood aimed at an anycast IP does not hit one target. Each source reaches whichever node is nearest to it, so the attack is split across every site automatically, in rough proportion to where the attackers are. A botnet concentrated in one region overloads the local node while the rest of the network keeps serving everyone else. Capacity scales simply by adding more sites, and a site that is saturated or taken offline drops out of BGP, so its traffic reroutes to the next nearest node within seconds.
The gotcha: stateless only
Anycast works because DNS over UDP is stateless. Each query is self contained, so it does not matter if two packets reach different nodes. Long lived stateful connections are a different story. If a route changes mid connection, packets can suddenly arrive at a node that has no record of that TCP session, and it breaks. DNS over UDP sidesteps this entirely. For TCP based services, operators pin flows carefully or accept that reconvergence may reset a session. This is why anycast and DNS are such a natural fit.
Seeing it yourself
The IP a resolver reports can differ by location, which is exactly the anycast effect. To inspect what a name resolves to from where you are, the DNS Lookup tool queries records directly and shows you the answer your own path returns.