DIY BYOIP- a new way to Bring Your Own IP prefixes to Cloudflare
Nov 7, 2025Ash Pallarito, Lynsey Haynes, Gokul Unnikrishnan
Summary
This post introduces a self-serve BYOIP API that automates the onboarding of customer IP prefixes to Cloudflare. The process leverages RPKI ROAs for intent verification and IRR/rDNS record modification for ownership verification, replacing the manual LOA process. This significantly reduces onboarding time from weeks to minutes and enhances security by relying on cryptographic validation rather than manual document review. The initial scope is limited to prefixes originated from Cloudflare's ASN (AS13335) due to ROA availability.
More from the DNS Infrastructure & Naming Conventions trail
- The keys to the Internet change on October 11, 2026. Are you ready?
- 1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it
- How we saved 100 terabytes of memory by optimizing 1.1.1.1’s DNS cache
- BGP ORIGIN attribute manipulation and its impact on the Internet
- Cloudflare Internal DNS is now generally available