CHINAGATEWAY.PRO

Article

China CDN for Foreign Companies: What It Requires First

September 28, 2026

TL;DR

  • A CDN that cuts China load times has its edge inside the mainland. An offshore edge — however large — does not touch the cross-border hop.
  • A CDN acceleration domain serving mainland or global traffic must clear an ICP filing first. Outside-mainland-only acceleration (Hong Kong, Macau, Taiwan) needs a Public Security Bureau filing instead.
  • The filing cannot run on an Alibaba Cloud international account: the international site does not support ICP filing, and the filing application system is Chinese-only.
Mainland China CDN prerequisite chain — an ICP-filed acceleration domain and China-site account gate in front of any mainland edge node
The filing comes first — mainland edge nodes serve only filed acceleration domains

You audited your site's performance from mainland China (why your website is slow in China), watched an offshore CDN change nothing, and someone proposed “a China CDN.” Good instinct — but a China CDN for foreign companies is mostly paperwork that must finish before any edge node serves your traffic, not CDN configuration. This article walks the full prerequisite chain: domain, filing, acceleration domain, and the account gate that catches foreign teams off guard.

What a China CDN for foreign companies actually means

A CDN only improves performance for a visitor when a cached copy of the requested asset lives on an edge server close to that visitor. For mainland China users, “close” means inside the country. An offshore CDN with no mainland edge still serves China visitors from datacenters abroad; the cross-border transit path — congested international links and DNS resolution outside the country — remains untouched.

Mainland CDN providers place edge nodes on China networks. Alibaba Cloud CDN operates 3,200+ nodes worldwide, with coverage in 70+ countries and regions and total bandwidth exceeding 180 Tbps. Of those, more than 2,300 nodes sit inside the Chinese mainland across all 31 provincial-level regions, with many in provincial capitals. The remaining 900+ nodes cover overseas markets and Hong Kong, Macau, and Taiwan.

Cloudflare runs a distinct “China Network,” constructed with strategic partners in China. Performance and security rules are applied at Cloudflare's edge across the country, and the network supports use cases such as serving static content to users in China and deploying Workers serverless from mainland datacenters. The operating partner named in Cloudflare's documentation is JD Cloud.

The point: a “China CDN” is only useful when its edge is physically inside the mainland. Everything below is what it takes to put that edge in front of your traffic.

The prerequisite chain: domain → ICP filing → CDN acceleration domain

Before you configure any CDN, understand the filing rule that governs every mainland-serving acceleration domain. The ICP filing (Bei'an) is China's mandatory registration for most mainland-hosted websites — and an acceleration domain needs it before it may serve the mainland.

Mainland or global acceleration region: the acceleration domain must hold a valid ICP filing. Alibaba Cloud's documentation says a CDN domain accelerating the Chinese mainland or global regions needs the filing first. Tencent EdgeOne's use-limits page applies the identical rule. Cloudflare's China Network requires a valid ICP filing or license for each apex domain before enablement.

Outside-mainland-only acceleration (Hong Kong, Macau, Taiwan): no ICP filing is needed. A Public Security Bureau (PSB) filing is required instead — and an offshore region still keeps mainland visitors on a cross-border path (see Hong Kong server vs mainland China server: what changes).

Unfiled domains get blocked. If a domain resolves to mainland servers without a filing held at that provider, the provider's monitoring system identifies and blocks access. Alibaba Cloud's monitoring does this; EdgeOne restricts unfiled domains to its Global-AZ-excluding-mainland region. The filing is not optional — it is the access gate.

The filing attaches to the server provider, not the domain registrar. A domain registered elsewhere can still file at a given provider if the server infrastructure sits there. The filing holder is typically a WFOE (Wholly Foreign-Owned Enterprise); the provider must accept the entity type and business category. For who can hold the filing and how the entity choice ripples through hosting and documentation, see WFOE vs Hong Kong Company: ICP Filing Entity Rules.

For the filing process and timeline, see the ICP filing timeline.

The China CDN bring-your-own-domain checklist

Once you know the filing is in place, configuring the CDN domain itself follows a predictable pattern.

1. File the apex domain first

The ICP filing is issued against the apex domain (e.g. example.com). Subdomains of a filed domain need no separate filings. This means one filing covers every CDN acceleration domain you later configure under that apex.

2. Use a subdomain as the acceleration domain

Alibaba Cloud recommends using a subdomain such as video.example.com or *.example.com as the CDN acceleration domain. The wildcard form lets you route multiple subdomains through the same CDN configuration without adding separate filings for each.

3. The domain need not be registered at the CDN provider

Filing is mainly tied to the server provider, not the registrar. Your domain can sit at any registrar; the filing attaches to where the server infrastructure sits. For Alibaba Cloud CDN specifically, the filing does not need to name Alibaba Cloud as the service provider — the domain only needs to hold a valid filing.

4. Expect a domain-certificate upload when the registrar differs from the provider

When the domain registrar is not the CDN provider, some provinces require a domain certificate upload during the filing or modification process. This is province-dependent. Tencent Cloud's documentation notes this requirement when the registrar is not Tencent Cloud.

5. Keep the ICP number in the page footer

The filing number must display in the site footer. Without it, provincial Communications Administration (CA) review fails during related filings. This is not cosmetic — it is a compliance requirement enforced at review time.

6. Plan the 2–4 week filing window before any CDN go-live date

ICP filing typically takes 2–4 weeks with complete documents and a qualified entity. Operating without one risks domain blocking. Build your project timeline around the filing, not around CDN configuration.

Alibaba international vs China accounts: the gate foreign teams hit first

Here is the mistake that stops foreign infrastructure teams cold. The Alibaba Cloud International site does not support ICP filing. To apply for an ICP filing, you must use an Alibaba Cloud China site account (aliyun.com) or the GoChina ICP Filing Assistant. The filing application system is available only in Chinese — you must be able to read and write Chinese to complete the process.

This means the account you bought the CDN on may not be the account that can file. International-site accounts cannot submit ICP or app filings. The account-level gate is worth checking before you commit to a provider — the Alibaba vs Tencent Cloud comparison covers it.

Regional communications administrations set their own rules for information submission, materials, modification, and provider changes. If a filing is held at another provider and you want to add Alibaba Cloud as the service provider, you must complete a provider-change process first.

Mainland CDN vs global CDN with a China add-on

Not every CDN product is the same shape. Two models reach mainland visitors:

Alibaba Cloud CDN (mainland acceleration): rides 2,300+ mainland nodes directly. Billing is pay-as-you-go by default or pre-paid resource plans; the basic service fee is billed by traffic (the default), peak bandwidth, or monthly 95th-percentile peak bandwidth. Usage is billed by visitor-IP region, with the Chinese mainland as its own billing region. The prerequisite is an ICP filing on the acceleration domain and a China-site account that can hold that filing.

Cloudflare China Network: runs selected Cloudflare performance and security products on mainland datacenters operated by JD Cloud. The documented access requirements:

First-time zone enablement takes approximately 24–48 hours. IPv6 is mandatory for mainland services and is auto-enabled on China Network domains.

Cloudflare's documentation states no China-entity requirement. JD Cloud — not Cloudflare — holds the MIIT licenses required to operate and provide CDN services in China. Neither Cloudflare nor JD Cloud handles ICP applications; Cloudflare can refer customers to ICP partners. If an ICP filing or license is revoked, JD Cloud may suspend or terminate the China service, and Cloudflare reroutes the affected domains to the nearest datacenters outside China.

For the broader hosting and CDN decision, see mainland hosting and CDN infrastructure.

Which China CDN approach fits your situation

The right path depends on where you sit in the filing and account sequence. This matrix maps common situations to the recommended next step and the first thing to verify before you act.

Your situationRecommended pathFirst verification step
No ICP filing, international cloud account onlyMainland acceleration is gated; use a hybrid or offshore-only edge while you start the entity and filing project (fix paths compared; paths without a filing)Confirm your entity structure can pass ICP filing review (entity-readiness gate); run the China readiness diagnostic
Filing held at provider A, want provider B's CDNComplete the filing provider-transfer (the provider-change process at provider B) first; until it completes, provider B treats the domain as unfiled and blocks itConfirm which provider currently holds the filing
WFOE with China-site account, filing in progressPlan CDN configuration inside the 2–4 week filing window; subdomain acceleration domains ride the apex filingRun the ICP filing timeline estimator
Filed apex on Alibaba Cloud or Tencent CloudAdd subdomain acceleration domains; complete DNS ownership verification on first add; configure the HTTPS certificate for each domainConfirm the apex ICP number is valid and displayed in the page footer
Global CDN (Cloudflare) user needing mainlandChina Network = Enterprise plan + separate subscription + JD Cloud content vetting per zone; IPv6 is auto-enabled and cannot be disabledConfirm apex ICP filing or license exists before requesting JD Cloud vetting
Serving only Hong Kong, Macau, or TaiwanPSB filing instead of ICP — never mainland nodes; set the acceleration region to exclude the mainlandConfirm the acceleration region truly excludes the mainland in the CDN console
Mainland hosting already live, adding CDN accelerationAdd CDN acceleration domains under the existing apex filing; no new filing needed for subdomains of the filed apexConfirm the apex ICP filing is active and the ICP number is displayed
Choosing between Alibaba Cloud CDN and Tencent EdgeOneThe entity-readiness gate decides which provider portal your entity can actually file through; evaluate technical merits only after the gate clearsCheck that your entity type and business category are accepted on each provider's filing portal

Note: only MIIT-licensed operators may run mainland edge nodes. The CDN operator license and the site-level ICP filing are different instruments held by different parties — the operator holds the license; the website holder holds the filing. The same licensed-operator shape covers global clouds: AWS China Regions and Azure China (21Vianet) place their platforms behind local licensed partners.

What the filing-first rule does to your timeline

The filing is the critical path. With complete documents and a qualified entity, ICP filing typically takes 2–4 weeks. The Alibaba Cloud filing flow runs: submit information → Alibaba initial review (1–2 working days with phone verification) → MIIT (Ministry of Industry and Information Technology) SMS verification within 24 hours → CA review within 20 working days → filing number issued plus public-security filing.

Two patterns keep the launch timeline moving while the filing runs:

The hybrid path. If your architecture separates concerns — a global site for international visitors plus a mainland-hosted path for China users — the mainland path can go live while entity and filing work progresses in parallel. For the full hybrid approach and its trade-offs, see paths to reach China without an ICP filing.

Subdomains ride the apex filing. CDN acceleration domains use subdomains of the filed apex domain. Because subdomains of a filed domain need no separate filings, you can add multiple acceleration domains (for different services, regions, or environments) without restarting the filing process.

Either way, the filing — not the CDN configuration — sets the go-live date.

Frequently asked questions

Do I need an ICP filing to use a CDN in China?

For an acceleration domain serving mainland or global traffic: yes. Both Alibaba Cloud CDN and Tencent EdgeOne require a valid ICP filing before mainland or global acceleration is enabled. For outside-mainland-only acceleration (Hong Kong, Macau, Taiwan), no ICP filing is needed — a Public Security Bureau filing is required instead.

Does the CDN need its own domain?

You configure a CDN acceleration domain, but it does not need to be a separate registered domain. Use a subdomain of your filed apex domain — for example, video.example.com or *.example.com. Subdomains of a filed domain need no separate filings.

Can we use Cloudflare in mainland China?

Yes, via the Cloudflare China Network. The access requirements are: a Cloudflare Enterprise plan with the China Network added as a separate subscription, a valid ICP filing or license for each apex domain, display of the ICP number in the page footer, and JD Cloud content vetting before enablement. JD Cloud — not Cloudflare — holds the MIIT licenses to operate CDN services in China.

Can we use Amazon CloudFront in mainland China?

What AWS's mainland documentation does not state is whether CloudFront can serve mainland visitors — and this page makes no claim in either direction. What is documented is the structure: the AWS China Regions — China (Beijing), operated by Sinnet, and China (Ningxia), operated by NWCD — operations separate from AWS Global Regions, each requiring a separate AWS (China) Account. The operator/site split holds there as everywhere else: only MIIT-licensed operators run mainland edge nodes, with Sinnet and NWCD responsible for supporting and verifying the ICP Recordal and ICP License for their region customers, and the filing held by the website holder. Any AWS-adjacent mainland delivery plan therefore resolves to the same two questions as every other provider: which licensed operator holds the edge, and which entity holds the filing.

Can we file ICP from our Alibaba Cloud international account?

No. Alibaba Cloud International site accounts cannot submit ICP or app filings. You need an Alibaba Cloud China site (aliyun.com) account or the GoChina ICP Filing Assistant. The filing application system is available only in Chinese.

What happens if we point an unfiled domain at a mainland CDN?

The provider's monitoring system blocks access to the domain until the filing completes. Alibaba Cloud identifies and blocks unfiled domains resolving to its mainland servers. Tencent EdgeOne restricts unfiled domains to its Global-AZ-excluding-mainland region. The domain will not serve traffic until the filing is in place.

Does a China CDN replace mainland hosting?

No. A CDN is a cache layer in front of your origin server. If the origin sits offshore, the cross-border hop remains for every dynamic request and every cache miss. The fix-path comparison in why your website is slow in China lists mainland CDN and mainland hosting as separate rows with different effort bands. A CDN without mainland hosting speeds up static assets; it does not move your origin.

Does a CDN remove the ICP-filing need?

No. The filing sits first in the prerequisite chain: an acceleration domain cannot serve the mainland or global regions until it holds a valid ICP filing, and both Alibaba Cloud CDN and Tencent EdgeOne enforce that before enabling acceleration. The CDN does not bypass the chain — the filing completes before the edge turns on. For the sequence in full, see the prerequisite chain above; for the short hub answer, see the FAQ hub.

What drives China CDN cost?

Alibaba Cloud CDN bills the basic service fee by one of three models: pay-by-traffic (the default), peak bandwidth, or monthly 95th-percentile peak bandwidth. The Chinese mainland is its own billing region for visitor-IP-based pricing, and HTTPS requests are billed separately as a value-added service. A bandwidth cap (feng ding) acts as a cost guard against traffic spikes. For the full cost-layer breakdown — the CDN entry tier, the filing's time cost, and the account split — see CDN billing models and what drives the bill.

What are the onboarding steps, in order?

The sequence runs: confirm you have a China-site account that can hold the ICP filing → file the apex domain → add subdomain acceleration domains with DNS ownership verification on first add → configure the HTTPS certificate for each acceleration domain → switch DNS via CNAME → test from inside China across carriers. The apex filing is the critical path; CDN configuration follows, not the other way around. Alibaba Cloud CDN documentation walks the CNAME switchover flow and the first-add DNS verification step.

Does the acceleration domain need its own HTTPS certificate?

Yes. Alibaba Cloud CDN documentation states the HTTPS certificate must be configured on the acceleration domain, or the domain will not serve HTTPS. Each acceleration domain needs its own certificate configuration. HTTPS requests are billed as a value-added service, separate from the basic service fee.

China add-on vs provider-native mainland CDN — what are the switching costs?

Cloudflare China Network requires an Enterprise plan with the China Network added as a separate subscription, per-zone JD Cloud content vetting, and a valid ICP filing for each apex domain. If the ICP filing or license is revoked, JD Cloud may suspend or terminate the China service, and Cloudflare reroutes affected domains to the nearest datacenters outside China. Switching from one provider-native CDN to another requires a filing provider-transfer first if the existing filing is held at the original provider.

How do we verify and monitor the CDN from inside China?

Run per-carrier measurements — China Telecom, China Unicom, and China Mobile — separately, never averaged. For every run, record the timestamp, network type, first-render time, and time to first byte. Use mainland test services such as 17ce.com, ping.chinaz.com, or boce.com. The complete measurement procedure is in how to verify the edge from inside China.

Why do acceleration domains or filings get rejected or blocked?

Four causes cover most rejections and blocks. An unfiled domain resolving to mainland servers gets blocked by the provider's monitoring system. The entity type or business category may not qualify on the chosen provider's portal. Document mismatches — a business license naming a different entity, a domain certificate with the wrong registrant — come back for correction, stretching the timeline. Domain real-name verification must match the filing information, and domains registered at international registrars on or after 2018-01-01 must transfer to a mainland registrar before filing can proceed. What happens after a rejection — provider pre-review, rejection comments, fix-and-resubmit — is detailed in the timeline guide's rejection walkthrough. For the full website-pipeline rejection catalog — every documented reason and its fix — see which rejection reason applies to your filing.

Next steps

Setting up a China CDN is a filing project first and a CDN configuration project second. If you are still evaluating overall readiness, the 10-point China readiness diagnostic covers the entity and filing questions at rows 9 and 10. For help navigating the ICP filing, choosing between provider accounts, or configuring mainland acceleration, reach out at hello@chinagateway.pro or explore our mainland hosting and CDN infrastructure service.

ICP Filing for Foreign Companies: Step-by-Step Timeline

Plan the 2–4 week filing window before any CDN go-live date.

How to Test Your Website from China Without Flying There

How to confirm your acceleration domain actually serves from mainland edges.

Can You Reach China Without an ICP Filing? Hybrid Architecture Paths and Trade-offs

Where an offshore edge fits — and where it never touches the hop.

Need help setting up a China CDN?

We cover the prerequisite chain — filing, acceleration domain, provider account — and the CDN configuration that follows. See our mainland hosting and CDN infrastructure service.

hello@chinagateway.pro