DIY BYOIP: a new way to Bring Your Own IP prefixes to Cloudflare

According to Cloudflare, BYOIP users can now onboard and manage their own IP prefixes through a new self-serve BYOIP API, eliminating the previous multi-team, manual process that could take 4–6 weeks. The approach combines automated ownership checks with RPKI guidance, using ROAs to authorise Cloudflare’s origination of prefixes and enabling LOAs to be generated on behalf of customers when needed.

To verify ownership, Cloudflare relies on a two-step process involving either an IRR modification or reverse DNS TXT records, plus a unique, single-use validation token added to the relevant record. The update limits initial onboarding to BYOIP prefixes originated from Cloudflare’s ASN AS13335, relying on ROA-backed signals rather than broader ASPA capabilities. This shift aims to improve speed and security by reducing human review, while still supporting operators who rely on LOAs for global routing acceptance.

The article notes that this is part of a broader evolution of Cloudflare BYOIP, including improvements to IPAM and the ability to run multiple services on a single BYOIP prefix, with the new self-serve onboarding rolling out in coming months. 7 November 2025