# Akamai CDN and Property Manager — Edge Hostname, Cache Proof and the CLI Ladder Source: https://ai.techclick.in/blog_akamai_intelligent_edge_cdn_property_manager Markdown: https://ai.techclick.in/blog_akamai_intelligent_edge_cdn_property_manager.md Publisher: Techclick Infosec Pvt Ltd A production runbook for Akamai Intelligent Edge CDN in 2026: DNS CNAME to an edge hostname, Ion and Property Manager rule trees, origin and cache keys, Site Shield, Fast Purge, Pragma versus Enhanced Debug, and the CLI commands that prove HIT versus MISS. Most engineers think… Most people describe Akamai as 'the CDN in front of the site' and stop. That sentence is true and useless on a bridge call. The ticket is always more specific: the hostname is not on the edge, the edge is reaching the wrong origin, the object is not cacheable, or yesterday's HTML is still in cache. The working model is operational: three hostnames , two TLS connections , a versioned property that must be activated, and a small set of response headers that tell you whether the edge served cache or went to origin. If you cannot name those, you will debug the origin while the fault is still in DNS. Akamai Intelligent Edge — DNS to origin infographic Start here: three hostnames, two TLS hops, then cache versus origin. The CLI lesson below proves each hop. ## ① What Akamai Intelligent Edge actually is — two hops, three names Akamai's delivery platform is a global anycast edge. A user never needs to know that. You do, because every outage sits on one of two connections: client to edge , or edge to origin . Keep three names distinct. The property hostname is what browsers request. The edge hostname is the CNAME target that puts the site on the Akamai network. The origin hostname is where your servers actually live. Public DNS for the property hostname must be a CNAME to the edge hostname . If you leave an A/AAAA to the origin, users bypass Akamai entirely. Lab names used below (illustrative, not a live tenant): shop.example.in → shop.example.in.edgekey.net → nearest edge IP, while the edge fetches origin.shop.example.in . Enhanced TLS edge hostnames use *.edgekey.net ; Standard TLS uses *.edgesuite.net . Visual — three hostnames, one CNAME If public DNS A-records the origin, Property Manager, cache and WAF never see the request. Figure 1 — Healthy Akamai request path Healthy Akamai request path DNS must land on the edge hostname before Property Manager or cache even exist. - Healthy Akamai request path User DNS shop.example.in CNAME edge *.edgekey.net Edge TLS client-to-edge cert Property rule tree applies Cache/origin HIT or fetch origin DNS must land on the edge hostname before Property Manager or cache even exist. Quick check · Q1 of 10 · Understand Why must the public hostname CNAME to the edge hostname instead of A-recording the origin? a) Because Akamai cannot speak TLS b) So user DNS lands on Akamai mapping; an origin A record bypasses the edge c) Because CNAME is faster than A d) Because origin hostnames are illegal in DNS Correct: b. Without the CNAME, browsers go straight to origin. Property Manager, cache and WAF never see the request. 👉 So far: Akamai delivery = property hostname CNAME to edge hostname, then edge TLS, then origin fetch. An origin A record bypasses the platform. ## ② Property Manager — the rule tree the edge actually runs Property Manager is the configuration that edge servers load after DNS lands the request. A property is a versioned container: hostnames, a rule tree, and product behaviours (Ion adds performance defaults; other products change the behaviour catalogue). You edit a version, then activate it to staging or production . An unactivated edit is a draft. A live site does not see it. ### Rules, matches, behaviours, CP codes The tree is IF/THEN. A match is the IF (path, file extension, hostname, request header). A behaviour is the THEN (origin server, caching TTL, redirect, HTTPS). There is always a Default Rule that matches everything. Nested child rules can override parents; Akamai documents trees up to five levels, with more specific children applying before the parent when both match. Every property needs at least one CP code in the default rule. Ion is the common web/app delivery product sitting on this same Property Manager model, with Adaptive Acceleration and cellular optimisation behaviours already in the tree. Includes are reusable rule snippets you version separately. Metadata on the network is the compiled XML of the activated version — that is why 'I saved it in Control Center' is not the same as 'production is running it'. Visual — Property Manager is a tree, not a save button A saved version is a draft. Staging is the rehearsal. Production activation is what the live edge runs. Figure 2 — What a property version actually contains What a property version actually contains Activation publishes this stack. Saving in the UI does not. What a property version actually contains Hostnames Property hostname bound to edge hostname Default rule Origin, CP code, HTTPS baseline Child rules Path/extension matches and TTLs Includes / extras Shared snippets, IM, EdgeWorkers Activation Staging first, then production Activation publishes this stack. Saving in the UI does not. 1 Property hostname tap to flip What users type (shop.example.in). Bound to one property and one edge hostname. Public DNS must CNAME here, not A-record the origin. 2 Edge hostname tap to flip Akamai CNAME target, typically *.edgekey.net (Enhanced TLS) or *.edgesuite.net (Standard TLS). Mapping picks the nearest edge IP. 3 X-Cache-Key tap to flip The ARL: serial, CP code, TTL token and path. Purge this when URL purge does not move the object. 4 Activation tap to flip A saved property version is a draft. Staging activation is the test network; production is the live metadata. Always prove staging with curl first. Staging is a different edge, not a flag on production A staging activation plus a hosts-file or staging edge hostname shows X-Akamai-Staging. Production curl will still show the old version until you activate production. Prove with headers, not with 'it looked fine in Control Center'. Quick check · Q2 of 10 · Remember What actually makes a Property Manager change live on the internet? a) Saving the version in Control Center b) Adding a CP code c) Activating that version on the production network (after staging proof) d) Restarting the origin Correct: c. The network runs activated metadata. Save is a draft; staging is the rehearsal; production activation is go-live. 👉 So far: Property Manager is a versioned rule tree (default + nested matches/behaviours + CP code). Saved ≠ live; staging then production activation is the go-live path. ## ③ Cache, origin, Site Shield and the extras that ride the same path On a cacheable GET, the edge looks up a cache key (ARL) . TCP_HIT / TCP_MEM_HIT means the object was fresh in cache. TCP_MISS means the edge (or a parent) fetched origin. X-Check-Cacheable: YES|NO answers the prior question: was this even allowed to be stored? A MISS on a NO is not a CDN failure; it is the property telling the edge not to cache. Tiered Distribution and Site Shield insert a parent layer so origin sees a small, stable set of Akamai IPs instead of the whole edge. When that is on, X-Akamai-Request-ID can look like {parent-id}.{child-id} and X-Cache-Remote tells you how the parent served. Origin ACLs must allow the Site Shield map, not random edge IPs. ### Same path, different products Image and Video Manager — transform and cache derivatives at the edge (the IM/RO debug family). - EdgeWorkers — JavaScript at the edge for request/response logic, not a substitute for WAF. - mPulse — real-user timing, not a delivery control. - Fast Purge — invalidate or delete by URL, ARL, CP code or cache tag. Invalidate marks stale; delete removes the object. Use ARL when the cache key is not the public URL. WAF (App & API Protector) is a security configuration bound to the same hostname. It is not this property. Mixing 'I changed the property' with 'I changed WAF' is the classic Bengaluru ecommerce ticket that wastes an hour. Visual — TCP_HIT versus TCP_MISS on the same 200 HTTP 200 does not tell you whether origin was touched. Read X-Cache together with X-Check-Cacheable. Figure 3 — One edge request, many products One edge request, many products Name the product that owns the symptom. Cache is not WAF; mPulse is not purge. - One edge request, many products Edge request one hostname Property cache Site Shield Image Manager EdgeWorkers mPulse RUM WAF (AAP) Name the product that owns the symptom. Cache is not WAF; mPulse is not purge. Figure 4 — TCP_HIT versus TCP_MISS — same 200, different ticket TCP_HIT versus TCP_MISS — same 200, different ticket Status code 200 does not tell you whether origin was touched. TCP_HIT versus TCP_MISS — same 200, different ticket TCP_HIT (healthy cache) X-Check-Cacheable YES Origin not in the hot path Stale content needs Fast Purge Do not restart origin for this ARL shows CP code and TTL TCP_MISS (origin involved) Cold object or not cacheable X-Check-Cacheable may be NO Origin ACL / Site Shield matters Latency is origin plus edge Fix cacheability before scaling Status code 200 does not tell you whether origin was touched. Treating TCP_MISS as a CDN outage MISS means origin (or a parent) was consulted. If X-Check-Cacheable is NO, the property is working as designed. If MISS is unexpected on a static asset, fix TTL and cache key, do not scale origin first. ### ▶ Watch shop.example.in get a cache HIT — then break DNS Healthy path lands on the edge and serves TCP_HIT. Break it by pointing DNS at origin. ① DNS CNAME shop.example.in CNAMEs to shop.example.in.edgekey.net; mapping returns a nearby edge IP. ▼ ② Edge TLS Client completes TLS to the edge certificate. Host header is still shop.example.in. ▼ ③ Property + cache Default plus /assets child rule apply. CP code 123456. Object is cacheable with TTL 2d. ▼ ④ TCP_HIT X-Cache: TCP_HIT. Origin is not touched. X-Cache-Key carries the ARL. Press Play for the healthy HIT, then Break it . ▶ Play Next ▶ ⚠ Break it ↺ Reset Quick check · Q3 of 10 · Apply curl shows X-Check-Cacheable: NO and TCP_MISS. What should you do first? a) Fix the property (or origin cache headers) so the object is allowed to cache, then re-test b) Purge the whole CP code c) Restart Apache on origin d) Switch to Standard TLS Correct: a. The edge is obeying a no-cache decision. Purging and restarting origin cannot create a HIT until cacheability is YES. 👉 So far: TCP_HIT vs TCP_MISS vs X-Check-Cacheable tells you whether cache, origin or a no-store rule is in play. Site Shield shrinks origin ACLs. Purge by ARL when the cache key is not the URL. ## ④ CLI troubleshooting — prove DNS, prove cache, then change Walk the ladder in order. Do not purge, and do not activate production, until the evidence names the layer. ### 1. Did DNS send the user to Akamai? Lab — dig the property hostname dig +short shop.example.in CNAME dig +short shop.example.in.edgekey.net A Sample output (illustrative) shop.example.in.edgekey.net. 23.45.67.89 If CNAME is missing and you get an origin A record, the edge is not in path. Fix DNS before you touch Property Manager. ### 2. Did this request hit the edge, and was it cached? Legacy Pragma still works on many properties. Prefer Enhanced Debug with a time-limited Akamai-Debug token when that behaviour is on — it maps cache to the same family of response headers. Lab — Pragma cache debug curl -sSI https://shop.example.in/assets/app.css \ -H 'Pragma: akamai-x-cache-on, akamai-x-cache-remote-on, akamai-x-check-cacheable, akamai-x-get-cache-key, akamai-x-get-true-cache-key, akamai-x-get-request-id' Sample response headers HTTP/2 200 server: AkamaiGHost x-cache: TCP_HIT from a23-45-67-89.deploy.akamaitechnologies.com (AkamaiGHost/11.4.0) x-check-cacheable: YES x-cache-key: /L/123456/2d/shop.example.in/assets/app.css x-akamai-request-id: 1a2b3c4d Header / value What it proves TCP_HIT / TCP_MEM_HIT Fresh object served from edge cache TCP_MISS Not in cache; fetched from origin or parent TCP_REFRESH_MISS Stale; origin returned a new object X-Check-Cacheable: NO Property (or origin headers) forbids cache — do not chase HIT X-Cache-Key ARL: serial, CP code, TTL token, path — use this to purge X-Akamai-Staging You are on staging (ESSL or EdgeSuite), not production ### 3. Activate and purge without guessing Lab — property CLI then Fast Purge by ARL akamai property-manager list-properties akamai property activate --property shop.example.in --version 18 --network staging --note 'cache TTL 2d for /assets' # After staging proof, same version to production. akamai purge invalidate --arl '/L/123456/2d/shop.example.in/assets/app.css' Staging first is not ceremony. Production activation distributes metadata globally. Fast fallback exists, but you should not need it because you already proved the version on staging with the same curl. If X-Check-Cacheable is YES and users still see yesterday's file, purge the ARL — URL purge misses when the cache key is not the public URL. Visual — CLI ladder before you purge Meera's stale hero image is a TCP_HIT of an old ARL. Purge that ARL. Do not purge the whole site first. Figure 5 — CLI ladder for a 'site is slow / stale' ticket CLI ladder for a 'site is slow / stale' ticket Each command clears one layer. Skip a rung and you will purge the wrong object. CLI ladder for a 'site is slow / stale' ticket dig CNAME on the edge? curl Pragma HIT or MISS? Read ARL X-Cache-Key Staging act. prove the version Purge ARL then re-curl Each command clears one layer. Skip a rung and you will purge the wrong object. Meera at a Bengaluru ecommerce shop faces this After a sale banner change, desktop users in India still see yesterday's homepage hero. Origin already has the new image. Mobile on a different subdomain looks fine. Likely cause shop.example.in is on Akamai with a long TTL on /hero/*. Origin was updated; the edge still has a TCP_HIT for the old ARL. The team A-recorded a test name to origin, so they thought the CDN was updated. Diagnosis dig shop.example.in CNAME still points at shop.example.in.edgekey.net. curl with Pragma shows TCP_HIT and X-Cache-Key /L/123456/2d/shop.example.in/hero/festive.jpg. X-Check-Cacheable is YES. dig CNAME → curl Pragma → read X-Cache-Key → Fast Purge ARL → re-curl Fix akamai purge invalidate of that ARL (or cache tag if tagged). Do not purge the whole site. Confirm a TCP_MISS of the new bytes, then subsequent TCP_HIT. Leave origin ACLs and Site Shield untouched. Verify Repeat curl from a second resolver: new Content-Length, TCP_HIT after the first MISS, X-Cache-Key unchanged path with fresh object. Staging is not required for a purge-only fix. Pragma / Akamai-Debug is the proof, not the homepage screenshot A browser screenshot cannot tell HIT from MISS. Capture X-Cache, X-Check-Cacheable, X-Cache-Key and X-Akamai-Request-ID in the ticket. If Enhanced Debug is enabled, pass the token; do not leave debug wide open on production. Quick check · Q4 of 10 · Analyze Users still see yesterday's CSS. X-Cache is TCP_HIT and X-Cache-Key is /L/123456/2d/shop.example.in/assets/app.css. Best next step? a) Change the origin IP b) Disable Site Shield c) Wipe the browser only d) Fast Purge that ARL, then re-curl until you see TCP_MISS then HIT of the new object Correct: d. The edge is correctly serving a cached object. Invalidate/delete the ARL; URL purge can miss when the cache key is not the public URL. 👉 So far: CLI ladder: dig CNAME → curl Pragma/Akamai-Debug → read ARL → activate staging → purge ARL → re-curl. Do not skip rungs. ### 🤖 Ask the AI Tutor Tap any question — instant, scoped to this lesson. No login, no waiting. What are the three hostnames in an Akamai delivery setup? What does Property Manager actually do? How do you tell a cache HIT from a MISS? When do you purge by ARL instead of URL? What is Site Shield for? What is the safe activation order? Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in. ## 📝 Wrap-up assessment — six more You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end. Q5 · Remember Which DNS record puts a site on Akamai? a) MX to origin b) CNAME from the property hostname to the edge hostname c) PTR to edgekey.net d) NS to the origin Correct: b. The property hostname must CNAME to the Akamai edge hostname so mapping can return the nearest edge IP. Q6 · Understand Enhanced TLS edge hostnames typically live under which domain? a) *.edgekey.net b) *.akamaized-origin.net c) *.example.in d) *.cloudfront.net Correct: a. Akamai documents Enhanced TLS on *.edgekey.net and Standard TLS on *.edgesuite.net. Q7 · Apply You need to confirm you are hitting Akamai staging, not production. What header do you look for? a) Strict-Transport-Security b) X-Cache-Key only c) X-Akamai-Staging (ESSL or EdgeSuite) d) Server: nginx Correct: c. Staging responses add X-Akamai-Staging. Production will not. Q8 · Analyze X-Cache is TCP_MISS and X-Check-Cacheable is YES on a static CSS file that should have been warm. What is the most likely class of issue? a) WAF deny b) Expired origin certificate only c) Bot Manager d) Cold cache, wrong cache key, or a purge — not a WAF problem Correct: d. Cacheable MISS is a delivery/cache-key problem. Do not open the security config for this symptom. Q9 · Evaluate A junior engineer wants to activate a TTL change straight to production. What is the best push-back? a) Production is always faster to test b) Activate staging, curl Pragma headers, then production for the same version c) Skip activation and purge everything d) Change origin .htaccess instead Correct: b. Staging is the rehearsal network. The same version then goes to production once X-Cache behaviour matches intent. Q10 · Evaluate Which statement is strongest in an interview? a) I would prove CNAME, then HIT/MISS and ARL, then change one layer (rule, purge or origin ACL) b) Akamai is a CDN so cache always hits c) I would reboot the origin first d) I would disable TLS to simplify Correct: a. L3 answers name the evidence path and one change. 'Cache always hits' is the myth that causes origin-blaming tickets. Submit all answers Try again Lesson complete — saved to your profile. Almost! You need 70% (7 of 10) — re-read the path that tripped you up and tap "Try again". ### 🧠 In your own words Type one line: which hostname was wrong, or which X-Cache value proved the fault? Then compare with the expert version. Compare with expert answer Expert version: A strong answer names one layer — DNS CNAME, property version, cacheability, ARL, Site Shield ACL or purge — quotes the header or dig output that proved it, and names the single change (activate staging, purge ARL, restore CNAME) plus the re-curl that closed the ticket. ### 🗣 Teach a friend Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary. Generate my one-liner 📩 Quiz me on this in 7 days. Opt in and we'll email 3 micro-questions on Akamai CDN and Property Manager at Day 1, Day 7 and Day 30 — spaced repetition is how this sticks. Un-tick any time. ### 📖 Glossary Property hostname The public FQDN users request. Bound to one property and one edge hostname. Edge hostname Akamai CNAME target (typically *.edgekey.net or *.edgesuite.net) used for mapping to an edge IP. Origin hostname Hostname only Akamai uses to fetch your servers after go-live. Property Manager Versioned rule tree of matches and behaviours the edge executes after DNS. CP code Content Provider code for billing and reporting; required on the default rule. ARL / cache key Akamai Resource Locator in X-Cache-Key; the precise object identity for Fast Purge. TCP_HIT / TCP_MISS X-Cache values: served from cache versus fetched from origin or a parent. Site Shield Parent layer that shrinks origin ACLs to a published Akamai IP map. Enhanced Debug Tokenised Akamai-Debug request header that returns cache and related debug response headers. #### 📚 Sources Akamai TechDocs — Welcome to Property Manager - Akamai TechDocs — Key concepts and terms (hostnames, CNAME, properties) - Akamai TechDocs — Request flow (client-to-edge, edge-to-origin) - Akamai TechDocs — Welcome to Ion - Akamai TechDocs — Pragma headers (X-Cache, X-Cache-Key) - Akamai TechDocs — Purge content by ARL ### What's next? Got the delivery path? Next, put App & API Protector on the same edge — Adaptive Security Engine, match targets, rate policies and the akamai appsec CLI. Next · All interview lessons → Practice on exam.techclick.in → --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt