Cloudflare BYOIP Integration Overview
Location
Searching for the best IP providers? Cloudflare’s Enterprise-only BYOIP program lets you bring your own IPv4 and IPv6 prefixes onto Cloudflare’s global anycast network so your applications can keep your IP space while using Cloudflare’s security and performance services. Since November 2025, Cloudflare has offered a self-serve BYOIP API for eligible onboardings, using RPKI plus IRR or reverse-DNS TXT ownership validation instead of relying only on manual LOA handling; however, Magic Transit onboarding still follows a separate account-team-led path rather than the generic self-serve BYOIP flow. Below you’ll find Cloudflare setup documentation, BYOIP requirements, commercial notes, and practical onboarding steps.
Provider Details
| Field | Information |
|---|---|
| Provider Name | Cloudflare |
| Website | Cloudflare Website |
| ASN(s) | 13335 (documented self-serve onboarding path); custom ASN and certain service-specific cases require coordination with Cloudflare |
| Regions Supported | Global anycast across Cloudflare’s network worldwide; service behavior depends on the product and service-binding configuration |
| Support Contact | Existing customers: confirm BYOIP contract coverage with your Cloudflare account team Magic Transit, custom-ASN, or non-standard onboarding: work through your account team / Cloudflare Professional Services New prospects: contact Cloudflare Sales |
| Tech Article & Date | DIY BYOIP: a new way to Bring Your Own IP prefixes to Cloudflare – November 2025 Bringing Your Own IPs to Cloudflare (BYOIP) – July 2020 Cloudflare outage on February 20, 2026 – February 2026 |
| BYOIP Scope | Enterprise-only BYOIP for IPv4 and IPv6 across Cloudflare services including CDN services, Spectrum, Magic Transit, Gateway DNS locations, and dedicated egress IP use cases. Service bindings allow compatible per-prefix or per-IP routing between supported services. |
| Supported Versions | IPv4 and IPv6 |
| Supported Services | CDN / WAF and related Layer 7 services, Spectrum, Magic Transit, Gateway DNS locations, dedicated CDN egress IPs, plus Address Maps for proxied DNS IP control |
Technical Requirements
| Requirement | Details |
|---|---|
| Prefix Size | IPv4: /24 minimum IPv6: /48 minimum |
| ASN Ownership Required | A dedicated customer ASN is not required for the documented self-serve path, but that path currently supports Cloudflare ASN AS13335 only. If you need your own ASN in the announcement path, or have a Magic Transit-specific routing design, coordinate with Cloudflare. |
| IRR or RADb Object | Required and must be current: exact route / route6 objects for the prefix, with the correct origin ASN. For ownership validation, Cloudflare can use IRR remarks / description fields containing the Cloudflare validation token. |
| ROA or LOA | Accurate RPKI ROAs are required for the modern validation flow. Self-serve onboarding validates RPKI plus IRR or reverse-DNS TXT ownership checks; Cloudflare can auto-generate LOA-style documentation for downstream acceptance. Manual or service-specific cases may still involve explicit LOA handling. |
| RIR Limitations | Prefixes must be registered under a supported Regional Internet Registry: AFRINIC, APNIC, ARIN, LACNIC, or RIPE NCC. |
Step-by-Step BYOIP Process
Cost and Limitations
| Item | Details |
|---|---|
| Fees | No public BYOIP list price is published. Commercial terms are enterprise-contract specific, so confirm pricing and packaging with your Cloudflare account team or Sales. |
| Bundled or Standalone | BYOIP is consumed through supported Cloudflare enterprise products rather than a public standalone plan. One onboarded prefix can support multiple compatible services through service bindings, but a single prefix can be used for either CDN ingress or dedicated CDN egress, not both. |
| Traffic/Peering Restrictions | Cloudflare announces the onboarded prefix from its global anycast network. Keep IRR and ROA records exact, avoid conflicting external announcements, and coordinate any custom-ASN or Magic Transit-specific route behavior through Cloudflare. |
| Other Limitations | Each onboarded prefix requires one default service binding covering the entire prefix. Additional bindings can be more specific. Service binding changes typically take about 4–6 hours to propagate and may briefly disrupt traffic during that window. Spectrum UDP applications are not supported with BYOIP. |
Automation & Developer Access
Abuse & Reputation Management
Related Resources
Cloudflare BYOIP Developer Docs
Cloudflare BYOIP Get Started
Cloudflare IP Address Service Bindings
Cloudflare Address Maps
Cloudflare Spectrum BYOIP
Cloudflare Magic Transit: Advertise Prefixes
DIY BYOIP: a new way to Bring Your Own IP prefixes to Cloudflare
Cloudflare outage on February 20, 2026
Bring your own IP space to Cloudflare – Reference Architecture
Cloudflare BYOIP GA Blog Post (2020)