A CDN Is Not IP Diversity: What Cloudflare Actually Changes About Your Hosting

Somebody will eventually tell you that IP diversity is a solved problem: put every site behind a CDN, and the only address the outside world can see belongs to the CDN. The argument is tidy, it costs nothing, and it is the most common reason operators talk themselves out of buying separate addresses. It is also wrong in a way that takes about ninety seconds to demonstrate on your own domains.

So here is the demonstration rather than the assertion. We run one of our own brands behind a CDN and two on their own nameservers, which makes our estate a usable test bench. We ran the same public lookup against them and wrote down what came back. What follows is that result, the method so you can repeat it, the full list of signals a proxy does not touch, and an honest account of when a CDN genuinely is enough. By Terry Cane, Chief Operating Officer, SEOHost.net.

What a CDN Actually Changes When You Put a Site Behind It

A CDN is a reverse proxy. Visitors resolve your hostname to the provider’s addresses, the provider fetches the page from your server, and your server never speaks to the visitor directly. That indirection is the whole product, and it is genuinely useful.

The plumbing is well documented. MDN describes the X-Forwarded-For header as the de-facto standard for identifying the originating client, and explains why it has to exist: when a connection passes through a reverse proxy, “the server only sees the final proxy’s IP address, which is often of little use.” Read that from the outside and you have the mirror image. The public sees the proxy too.

So one thing really does change, and it is worth having. Your public A record stops pointing at your server. Somebody who looks up your domain gets an address belonging to a network that fronts millions of other sites, and learns nothing about where you are hosted.

That is a masking property, and masking is not diversity. The question this post exists to answer is what the mask leaves visible, because the answer decides whether IP diversity is something you still need to buy.

We Ran the Lookup on Our Own Network: What a CDN Hides in Practice

Rather than argue from first principles, we measured it. Our own estate happens to be a controlled experiment: one brand sits behind a CDN and two answer from their own authoritative nameservers, on the same underlying infrastructure and the same team.

The Method, So You Can Run It on Your Own Domains

Four lookups against a public resolver, which is all anybody needs and all anybody has. Run each of these against a domain you own, then against a domain you are curious about. No account, no tooling, no privileged access.

• The address a visitor resolves: dig +short A example.com
• Which nameservers answer for the domain: dig +short NS example.com
• Where mail for that domain is delivered: dig +short MX example.com
• Your SPF record, among other things: dig +short TXT example.com

What Came Back

The table below is our own result, taken on 8 September 2026. Origin addresses are redacted to their first three positions, because the point is which records expose an origin rather than which specific machine ours is.

Lookup	Brand behind a CDN	Brand on its own nameservers	What an outsider learns
A	Two shared proxy addresses	One dedicated address	The CDN genuinely hides the origin here
NS	Two provider-assigned nameservers	ns1 and ns2 on the brand’s own domain	Either way, a reusable cross-site fingerprint
MX	Points at the domain itself	Points at the domain itself	Mail is not proxied, in both cases
SPF (TXT)	Names four origin addresses in plain text (69.160.55.xxx and others)	Names three origin addresses	The origin, published by us, in public DNS

The last row is the finding. The CDN did exactly what it promises on the web record and the mail record gave the origin away anyway. Nobody misconfigured anything; that is simply what the records are for.

The One Thing a Proxy Cannot Hide: Your Mail Has to Leave the Origin

This is structural rather than accidental, and it is worth understanding because no configuration change fixes it. RFC 7208, the specification for Sender Policy Framework, states that “SPF records MUST be published as a DNS TXT (type 16) Resource Record” and that such a record “declares which hosts are, and are not, authorized to use a domain name.” Its ip4 mechanism does that by listing addresses.

Put those two facts together. To send mail that is not rejected, you must publish, in public DNS, the addresses your mail actually leaves from. Those addresses are your origin. A proxy that sits in front of your website is not in the mail path and cannot edit that record.

Which means a domain that sends any email at all is publishing a pointer to its own infrastructure, permanently, by design. If several of your domains publish the same addresses, they are matched to each other in one query — and that query costs nothing to run against any domain, including yours.

What Else Survives a CDN: The IP Diversity Signal Ladder

Mail is the clearest case but it is not the only one. Below is every signal we know of that connects two sites you own, with an honest column for whether a proxy in front of them does anything about it.

Signal	Does a CDN hide it?	What actually separates it
Public A record	Yes — this is the one thing it does	Separate origins, or a proxy
SPF and mail records	No — mail bypasses the web proxy	Separate sending addresses
Certificate transparency logs	No — issuance is logged publicly	Nothing hides this; plan around it
Nameserver pair	No — it substitutes its own pair	Private nameservers per domain
Hosting account	No — one account, one suspension	Separate accounts
Interlinking between your sites	No — links are in the page	Editorial judgment, not infrastructure

The certificate row surprises people, so it is worth a sentence. Certificate transparency is a public logging system for issuance, and Let’s Encrypt states plainly that it submits every certificate it issues to CT logs. Every hostname you secure is therefore published, whether or not a proxy fronts it. That is a good thing for the web and a fact you should plan around rather than fight.

Read down that middle column and the shape of the answer appears. A CDN handles exactly one row. Everything else is decided by how the hosting underneath is arranged, which is what IP diversity actually refers to.

So Does IP Diversity Still Matter in 2026?

Having spent four sections explaining what a CDN does not do, honesty requires the harder question. If the proxy is not the answer, is separation itself worth paying for?

The Ranking Argument Was Always the Weak One

We sell separation, and we would still rather you heard this from us than discovered it later. There is no documented address-based ranking input. Google’s spam policies define link spam as “creating links to or from a site primarily for the purpose of manipulating search rankings” — a description of behavior on the page, not of where the page is hosted. If a network is going to attract attention, the links are why. Our honest reassessment of Class C IPs works through that argument in full.

What IP Diversity Actually Buys: Blast Radius

The real case is operational and it survives every version of the ranking debate. Separation decides how far one bad day travels. One compromised site, one blocklist entry, one abuse complaint or one billing dispute reaches everything that shares its address and its account, at the same moment and with no warning.

That exposure is measurable in a way rankings are not. Count the properties you could not rebuild in a month, and ask how many of them currently sit behind one suspension. For a lot of estates the answer is all of them, and no proxy changes it. Our comparison of SEO hosting and PBN hosting covers where interlinking turns that exposure into something worse.

When a CDN Is Enough, and When You Need Real IP Diversity

Here is the decision, stated as plainly as we can manage while selling one of the columns. Most readers land in the first row and should stop there.

Your situation	What you actually need	Why
One business site, a CDN in front of it	The CDN is enough	There is no second site to be separated from
Several sites, none of them load-bearing	The CDN is probably enough	Shared fate is a nuisance rather than a loss
Several sites, two or three you could not rebuild	Separation for those two or three	Lift the properties that matter, not the whole estate
A network that interlinks and sends mail	Separation, and separate nameservers	The proxy hides none of what connects them
Sites are slow or hitting resource ceilings	Neither — this is a capacity problem	Buying addresses does not buy CPU

If you land in the third or fourth row, the thing to buy is separation you can inspect. Every Class A IP hosting plan in the USA carries its own ns1 and ns2 per domain, free SSL, cPanel and WHM, and an IP Manager tool that shows you which site is on which address — because separation you cannot audit is just a claim. European estates run on the same terms with EU addresses, and mixed networks usually start on USA Class C plans and lift only the properties that earn it.

What You Are Actually Paying For, Either Way

Both products are priced by scarcity, and they are scarce for different reasons. Understanding which one you are buying stops you paying for the wrong scarcity.

A CDN sells capacity, which is abundant and getting cheaper. Addresses are the opposite. ARIN records that its free pool of IPv4 address space was depleted on 24 September 2015, and that new requests now go on a waiting list filled only when addresses are returned or transferred. The IANA IPv4 Address Space registry shows the whole allocation, and there is no unclaimed column in it.

One piece of vocabulary deserves correcting while we are here, since we use it on our own product pages. The class letters are market shorthand, not networking. RFC 4632, the Best Current Practice document for CIDR, records that the community chose “to deprecate the Class A/B/C network address assignment system” in favor of classless blocks. The words survived because the product did. What you buy is a prefix.

Where the constraint is speed or resources rather than separation, the honest answer is neither product. An SEO VPS or a dedicated server addresses a capacity ceiling; addresses do not. Our breakdown of when the VPS upgrade is real sets out the thresholds, and the transparent pricing breakdown has the numbers.

Check What Your Own Setup Separates

Set the four switches to match your current arrangement. The tool lists which signals still connect your sites to each other, using the same ladder as the table above.

Frequently Asked Questions About IP Diversity

Does putting my sites behind a CDN give me IP diversity in 2026?

In practice, no. A CDN changes what a public lookup returns for your web address; it does not change which machine your sites actually live on. Everything behind the proxy still shares one origin, one hosting account and one fate. You have masked an address rather than acquired a second one, and IP diversity is the second thing.

CDN vs IP diversity: which one actually separates two sites I own?

By contrast with a proxy, which stands in front of a single shared origin, separate addresses change where the sites genuinely are. A CDN hides the origin from a casual lookup. IP diversity means there is more than one origin to find in the first place. Only the second one separates anything, because only the second one changes what is behind the curtain.

What does a CDN actually hide from Google in 2026, and what stays public?

Specifically, it hides one thing by default: the origin address in your public A record. Your mail records still name the origin, because mail does not travel through a web proxy. Certificate transparency logs still publish every hostname you secure. A shared hosting account still ties the sites together behind the proxy, and so does a single nameserver pair.

Why does my SPF record still name my origin IP address behind a CDN?

Ultimately, because mail leaves the origin rather than the proxy. RFC 7208 requires an SPF record to be published in DNS as a TXT record declaring which hosts are authorized to send for your domain, and its ip4 mechanism does that by listing addresses in plain text. A proxy sitting in front of your website has no way to remove them.

How does SEOHost.net deliver IP diversity that a CDN cannot?

Notably, by giving each site a different origin instead of one shared origin behind a mask. Every plan carries its own ns1 and ns2 per domain, cPanel and WHM, free SSL, automated backups and an IP Manager tool you can open and audit. The separation is a property of the hosting itself, which is the part a proxy is structurally unable to supply.

Does IP diversity still matter for SEO, or has Google moved past it?

In fact the ranking argument was always the weakest reason to buy it, and we would rather say so than sell past it. Google’s spam policies describe link schemes, not addresses, and no search engine documents an address as a ranking input. What separation genuinely buys is blast radius: how much of your estate a single suspension or blocklist entry reaches.

Shared IP vs dedicated IP: is either one actually bad for SEO?

Typically neither is bad on its own, and the framing is what misleads people. Thousands of reputable sites share addresses without consequence. The useful question is not whether an address is shared but whose fate you are sharing, and whether you would still be comfortable with that arrangement if one of those sites were suspended tomorrow morning.

Do my nameservers connect my sites even when IP diversity is in place?

Indeed they can, and it is the signal people forget most often. If forty domains all answer from one nameserver pair, that pair is a cleaner cross-site match than any address ever was, and buying separate addresses does not touch it. Private nameservers per domain are what closes that particular door.

Do SEOHost.net plans include private nameservers, or is IP diversity an add-on in 2026?

Fortunately both are in the plan rate rather than priced as extras. Private ns1 and ns2 per domain, free SSL, cPanel and WHM, the IP Manager tool, automated backups, free migration and the 30-day money-back guarantee are included on every band of every class. There is no diversity surcharge and nothing on that list is a paid upgrade.

Is SEOHost.net IP diversity worth buying if I already pay for a CDN?

That said, the two solve different problems and buying both is common. Keep the CDN for what it is good at, which is caching, absorbing traffic and keeping your origin off the public A record. Buy separation when the sites behind it must not share a fate. If your whole estate can still be taken down by one suspension, the proxy did not fix that.