# Network architecture

Every airdress has a name under `a.airdr.es`. Two anycast networks answer
for it: authoritative DNS, which says where the name lives, and a relay,
which carries IPv4 traffic to it without ever decrypting it. IPv6 clients
skip the relay and reach your airdress directly.

## Architecture overview

```mermaid
flowchart LR
    Client([Client]) -->|1. resolve name| DNS[DNS PoP<br/>185.43.32.1]
    Client -->|2a. IPv4, TLS| Relay[Relay PoP<br/>23.163.148.11]
    Relay -->|3. IPv6, still TLS| Op[Your airdress]
    Client -->|2b. IPv6, TLS| Op
```

| Piece | Address | What it does |
| --- | --- | --- |
| DNS PoPs | `185.43.32.1` (anycast) | Authoritative for `a.airdr.es`: answers where each airdress lives |
| Relay PoPs | `23.163.148.11` (anycast) | Accept IPv4 connections on ports 443 and 80 and pass them through to the right airdress |
| Your airdress | its own IPv6 address | Holds its certificate, terminates TLS, runs your functions, shells and plugins |

## Anycast and BGP

Airdress operates its own network, AS199154, and announces two prefixes from
every point of presence: `185.43.32.0/24` for DNS and `23.163.148.0/24` for
the relay. Anycast means the same address is announced from every location,
and the internet's routing delivers each client to the nearest one.

- **Failover without a DNS change.** When a PoP becomes unhealthy it
  withdraws its route, and traffic moves to the next-nearest PoP. The
  address a client uses never changes.
- **Separate prefixes, separate failure.** DNS and the relay each have
  their own prefix, so a relay PoP that withdraws sheds its traffic to
  another relay PoP rather than being captured by a DNS server in the same
  place.

The prefixes are published at [airdress.co/ips](https://airdress.co/ips)
(plain text), [airdress.co/ips.json](https://airdress.co/ips.json), and on
[airdress.co/network](https://airdress.co/network).

## Points of presence

Each location runs one relay PoP and one DNS PoP, on separate machines:

| Location | Region |
| --- | --- |
| Frankfurt | Europe |
| Amsterdam | Europe |
| Newark, NJ | US East |
| Los Angeles | US West |

A PoP is replaced by building its successor beside it, proving it healthy
while its routes are held back, and only then retiring the old one, so an
update does not darken a location.

## DNS: where an airdress lives

Your airdress's name, `<name>.a.airdr.es`, carries two records:

- an **A** record pointing at the relay, `23.163.148.11`;
- an **AAAA** record pointing at your airdress's own IPv6 address.

A change to a record reaches every DNS PoP within seconds. You can ask a PoP
directly:

```sh
dig +short A    <name>.a.airdr.es @185.43.32.1
dig +short AAAA <name>.a.airdr.es @185.43.32.1
```

## The relay: IPv4 without decryption

The relay listens on `23.163.148.11`:

- **Port 443:** it reads the server name the client asks for (TLS SNI),
  looks up that airdress's IPv6 address at the DNS PoPs, and connects the
  two. The TLS session runs end to end between the client and your airdress;
  the relay sees the name and the encrypted bytes, nothing else.
- **Port 80:** it reads the `Host` header and passes the connection through
  the same way, so plain HTTP and certificate challenges reach your
  airdress.

The relay only carries names it is responsible for. A request for a name
outside `a.airdr.es` (or a custom domain verified for an airdress) is
dropped without an answer.

## IPv6: straight to your airdress

A client with IPv6 resolves the AAAA record and connects to your airdress
directly. The relay is not on that path at all, so everything that decides
who may reach what runs on your airdress itself.

`airdress airdress probe` tells you which path the hub used to reach your
airdress: `direct (IPv6)`, `direct (IPv4)` or `relay (IPv4)`.

## Your own domain

A domain of yours can point at your airdress. Use a CNAME to your
airdress's `a.airdr.es` name, which follows its addresses on both IPv4 and
IPv6. At a zone apex, where a CNAME is not allowed, use your DNS provider's
CNAME flattening (ALIAS) if it has one; otherwise an A record to
`23.163.148.11`.

**Caution:** Do not copy your airdress's IPv6 address into your own zone as a literal
AAAA record. It can change when your airdress moves; a CNAME follows it.

## Security model

- **TLS ends on your airdress.** The relay never holds a certificate or a
  key for your name, and cannot read requests or responses.
- **Certificates are your airdress's own,** issued by a public certificate
  authority to the airdress itself and renewed by it.
- **Shells and agent chat add their own end-to-end layer** on top: your
  airdress routes their ciphertext and never holds a session key. See
  [Shells](/shells/) and [Agents](/agents/).

## Related

- [Glossary](/reference/glossary/): anycast, PoP, VIP and the other terms.
- [Connection troubleshooting](/troubleshooting/connection/): checking each
  hop when an airdress does not answer.
- [Public network information](https://airdress.co/network) for AS199154.