Skip to content
AirdressAirdressAirdress Docs

Network architecture

Every airdress has a name under a.airdr.es. Two anycast networks answer for it: authoritative DNS, which says where the name lives, and a relay, which carries IPv4 traffic to it without ever decrypting it. IPv6 clients skip the relay and reach your airdress directly.

Architecture overview

Section titled “Architecture overview”
flowchart LR
    Client([Client]) -->|1. resolve name| DNS[DNS PoP<br/>185.43.32.1]
    Client -->|2a. IPv4, TLS| Relay[Relay PoP<br/>23.163.148.11]
    Relay -->|3. IPv6, still TLS| Op[Your airdress]
    Client -->|2b. IPv6, TLS| Op
PieceAddressWhat it does
DNS PoPs185.43.32.1 (anycast)Authoritative for a.airdr.es: answers where each airdress lives
Relay PoPs23.163.148.11 (anycast)Accept IPv4 connections on ports 443 and 80 and pass them through to the right airdress
Your airdressits own IPv6 addressHolds its certificate, terminates TLS, runs your functions, shells and plugins

Anycast and BGP

Section titled “Anycast and BGP”

Airdress operates its own network, AS199154, and announces two prefixes from every point of presence: 185.43.32.0/24 for DNS and 23.163.148.0/24 for the relay. Anycast means the same address is announced from every location, and the internet’s routing delivers each client to the nearest one.

  • Failover without a DNS change. When a PoP becomes unhealthy it withdraws its route, and traffic moves to the next-nearest PoP. The address a client uses never changes.
  • Separate prefixes, separate failure. DNS and the relay each have their own prefix, so a relay PoP that withdraws sheds its traffic to another relay PoP rather than being captured by a DNS server in the same place.

The prefixes are published at airdress.co/ips (plain text), airdress.co/ips.json, and on airdress.co/network.

Points of presence

Section titled “Points of presence”

Each location runs one relay PoP and one DNS PoP, on separate machines:

LocationRegion
FrankfurtEurope
AmsterdamEurope
Newark, NJUS East
Los AngelesUS West

A PoP is replaced by building its successor beside it, proving it healthy while its routes are held back, and only then retiring the old one, so an update does not darken a location.

DNS: where an airdress lives

Section titled “DNS: where an airdress lives”

Your airdress’s name, <name>.a.airdr.es, carries two records:

  • an A record pointing at the relay, 23.163.148.11;
  • an AAAA record pointing at your airdress’s own IPv6 address.

A change to a record reaches every DNS PoP within seconds. You can ask a PoP directly:

Terminal window
dig +short A    <name>.a.airdr.es @185.43.32.1
dig +short AAAA <name>.a.airdr.es @185.43.32.1

The relay: IPv4 without decryption

Section titled “The relay: IPv4 without decryption”

The relay listens on 23.163.148.11:

  • Port 443: it reads the server name the client asks for (TLS SNI), looks up that airdress’s IPv6 address at the DNS PoPs, and connects the two. The TLS session runs end to end between the client and your airdress; the relay sees the name and the encrypted bytes, nothing else.
  • Port 80: it reads the Host header and passes the connection through the same way, so plain HTTP and certificate challenges reach your airdress.

The relay only carries names it is responsible for. A request for a name outside a.airdr.es (or a custom domain verified for an airdress) is dropped without an answer.

IPv6: straight to your airdress

Section titled “IPv6: straight to your airdress”

A client with IPv6 resolves the AAAA record and connects to your airdress directly. The relay is not on that path at all, so everything that decides who may reach what runs on your airdress itself.

airdress airdress probe tells you which path the hub used to reach your airdress: direct (IPv6), direct (IPv4) or relay (IPv4).

Your own domain

Section titled “Your own domain”

A domain of yours can point at your airdress. Use a CNAME to your airdress’s a.airdr.es name, which follows its addresses on both IPv4 and IPv6. At a zone apex, where a CNAME is not allowed, use your DNS provider’s CNAME flattening (ALIAS) if it has one; otherwise an A record to 23.163.148.11.

Security model

Section titled “Security model”
  • TLS ends on your airdress. The relay never holds a certificate or a key for your name, and cannot read requests or responses.
  • Certificates are your airdress’s own, issued by a public certificate authority to the airdress itself and renewed by it.
  • Shells and agent chat add their own end-to-end layer on top: your airdress routes their ciphertext and never holds a session key. See Shells and Agents.
Section titled “Related”