Configure an origin

Important notes

When CDN fetches resources from your origin, your origin incurs bandwidth charges. For example, if your origin is your IDC, you pay your IDC’s outbound bandwidth fees. If your origin is OSS, you pay OSS outbound traffic fees.

Add or modify origin information

1. Log on to the CDN console.

2. In the left navigation pane, click Domain Names.

3. On the Domain Names page, find the target domain name and click Manage in the Actions column.

4. In the Origin Information section, add or modify origin configurations as needed.

   • Click Add Origin Server to add an origin.

   • Click Edit next to an existing origin to modify its configuration.

   Parameter	Description
   Origin Info	Select the origin type and enter the origin address. OSS Domain Select a public endpoint of an OSS bucket under the same account from the drop-down list as your origin. Enter a public endpoint of an OSS bucket as your origin (private endpoints are not supported). Example: ***.oss-cn-hangzhou.aliyuncs.com. You can view your OSS public endpoints in the OSS console. Note For more information, see CDN acceleration of OSS resources. Traffic discount for origin pull from Alibaba Cloud OSS: To qualify for discounted pricing, set the origin type to “OSS domain” in the CDN console. This allows OSS to recognize origin traffic from Alibaba Cloud CDN as “CDN origin outbound traffic.” If you mistakenly set the origin type to "Origin Domain Name" in the CDN console, Alibaba Cloud OSS will classify the origin traffic from Alibaba Cloud CDN as "outbound traffic over Internet," and you won't be eligible for discounted pricing in this case. For detailed billing information, see Billing for CDN-accelerated OSS resources. When using Alibaba Cloud OSS as your origin, you must configure a default origin Host header. Set it to the public endpoint of your OSS bucket. Otherwise, the origin will be unreachable. When using Alibaba Cloud OSS as your origin, we recommend that you configure a default origin SNI. Set it to the public endpoint of your OSS bucket. Otherwise, OSS may apply rate limiting. IP You can configure one or more IP addresses as your origin. Private IP addresses are not supported. Both IPv4 and IPv6 addresses are supported, but you cannot use only IPv6 addresses—you must include at least one IPv4 address. Using the public IP of an Alibaba Cloud ECS instance as your origin bypasses manual review. To use IPv6 origin addresses, you must enable origin fetch over IPv6 in advance. If you do not enable it first, your IPv6 origin addresses will not take effect, causing origin fetch failures. For more information, see Configure origin fetch over IPv6. For best practices when using IP addresses as origins, see Accelerate ECS resources with CDN. Site Domain: You can configure one or more domain names as your origin address. Note For best practices when using domain names as origins, see Accelerate ECS resources with CDN. The origin domain name must differ from the accelerated domain name. If they are identical, requests loop between CDN and the origin, preventing origin fetch. Alibaba Cloud CDN now supports directly adding an instance address of an Alibaba Cloud ALB instance (for example: example.hangzhou.alb.aliyuncs.com) as the origin. To configure DNS and origin settings in a CDN + ALB architecture: In your DNS provider’s console, create a CNAME record that points your accelerated domain name to the CNAME address assigned by CDN. You can find this CNAME address on the Domain Names page in the CDN console. In the CDN console, set the origin type to Site Domain and enter the ALB instance domain name as the origin. After configuration, the request flow is: client → CDN → ALB → server. Do not point your domain name directly to ALB. CDN acceleration will not work. Origin domain name format: Length: 1–67 characters. Allowed characters: lowercase letters (a–z), digits (0–9), and hyphens (-). Example: example.com. Not allowed: Chinese characters, uppercase letters (A–Z), or symbols other than hyphens (-). Hyphens cannot appear consecutively, stand alone, or appear at the start or end. If your domain contains Chinese characters (for example: 阿里云.网址), complete ICP filing for the Chinese version, then use a third-party Punycode tool to convert it to ASCII (for example: xn--fiq**.xn--eq**). Function Compute Domain: You can configure a Function Compute domain under the same account as your origin address. Select the Function Compute Region and Domain Name. For instructions, see Configure a custom domain.
   Priority	You can configure primary and secondary origins. When a user request triggers an origin fetch, Alibaba Cloud CDN first tries the primary origin. If the primary origin fails (TCP connection between CDN node and origin fails), it falls back to the secondary origin. Priority values range from 0 to 127. The lower the number, the higher the priority. The default priority for a primary origin is 20; for a secondary origin, it is 30. For example, if you have two origins, A and B, with origin A set as primary and origin B as backup, user requests that perform an origin fetch through Alibaba Cloud CDN will be directed to origin A first. If origin A fails (the TCP connection between the CDN node and the origin fails), the request will be redirected to origin B. When origin A recovers, traffic will switch back from origin B to origin A.
   Weight	When multiple origins share the same priority, Alibaba Cloud CDN distributes user requests across origins proportionally based on their weights, enabling weighted load balancing. Set weights according to your business needs. Range: 1–100. Higher values mean a larger share of requests. Default value: 10. Example: Origins A and B both have primary priority. A has weight 80; B has weight 20. Requests are distributed in an 8:2 ratio between A and B. Note In some cases, the actual distribution of origin fetch requests may not match the configured weights. Examples: Low origin fetch QPS (for example, under 10 QPS) leads to uneven probability distribution, causing actual weights to deviate from configured values. All requests come from one (or a few) IP addresses. Since a single IP maps to one CDN node, and TCP session persistence exists between CDN and origins, most requests may go to the same origin. To verify that actual origin fetch weights align with your configuration, use a third-party network probe tool. Configure probe clients across diverse geographic locations and ISPs, and run the test long enough to collect sufficient valid data.
   Port	This is the port that CDN uses to request resources from your origin. The default is 80. You can customize the port based on your origin’s support. Valid ports range from 1 to 65535. Default value: 80. If you set the port to 443, origin fetch uses HTTPS. For port 80 or any other custom port, origin fetch uses HTTP. Note To use HTTPS on a custom port other than 443, see Configure origin protocol policy. If you enable the Origin Protocol Policy feature (disabled by default), the port setting here is ignored. To disable origin protocol policy, see Configure origin protocol policy. When using an OSS domain as your origin, whether custom ports are supported depends on OSS.

5. Click OK to complete the configuration.

Retry on 5XX error, origin timeout, and origin probing

• Origin fetch retry order:

  • Retries follow origin addresses in the origin list from highest to lowest priority.

  • If multiple origins share the same priority, retries follow the configured weight ratios.

• Retry granularity:

  • Retries occur at the IP address level. If your origin is a domain name, CDN retries all IP addresses resolved from that domain. Only after all IPs fail does CDN try another available origin.

  • During retries, the system automatically skips origins marked as unavailable in the dead table.

• Retry status codes:

  • CDN nodes retry when they receive a 5xx status code from the origin.

• Origin connection timeout: When the origin server actively responds with a retry status code, CDN nodes retry as soon as they receive the retry status code. If the origin server does not actively respond with a retry status code, the system follows the origin connection timeout handling logic and triggers a retry from CDN nodes after the timeout period elapses.

  • Origin TCP connection timeout: 10 seconds.

  • Origin write timeout: 30 seconds by default (timeout after connection is established but data write stalls).

  • Origin read timeout: defaults to 30 seconds (after establishing a connection to the origin server, if the origin server fails to fully respond with the content requested by CDN nodes within the specified time).

  • You can adjust origin write and read timeouts by configuring the origin HTTP request timeout.

• Origin probing logic:

  • TCP connection failure: If attempts to establish a TCP connection between CDN nodes and an origin IP address fail on two consecutive attempts (either due to connection establishment failure or connection timeout), CDN removes that origin IP address from the list of available origin server addresses and adds it to the dead table, so that subsequent origin requests do not attempt to access this origin IP address. Afterward, CDN nodes probe the origin IP address every 5 seconds by attempting to establish a TCP connection. If the connection succeeds, the origin IP address is restored to the list of available origin server addresses.

  • When the TCP connection is normal: If the TCP connection between CDN and the origin IP address is normal, but you receive retry status codes (for example, 5xx) in the origin server response, the system triggers the retry logic. However, the origin IP address remains in the list of available origin server addresses, and subsequent requests will still be sent to this origin based on its weight. In other words, when the Layer 4 TCP connection is normal, Layer 7 HTTP request failures do not automatically block the origin IP address. If you want the system to block the origin IP address when Layer 7 HTTP request failures occur, you must submit a ticket to request this configuration.

References

• For an overview of origins, see Origin.

• When using multiple origins, you can specify different origin Host headers to direct origin fetch to different origins. See Configure default origin Host header.

• To customize HTTP or HTTPS origin protocols, see Configure origin protocol policy.

• If your origin is a private OSS bucket, enable private OSS bucket origin fetch for your accelerated domain. See Private OSS bucket origin fetch.

• If your origin IP hosts multiple domains and you use HTTPS for origin fetch, configure origin SNI. See Configure default origin SNI.