Only one X-Served-By with shielding


Hi all,
According to the X-Served-By header should contain two nodes if shielding is enabled. Except when the request happens to go directly to the shielding datacenter.

Still, we see a lot of
X-Served-By: cache-lcy1129-LCY
and the like while Frankfurt is selected as shield.

Any idea how this could happen?

We have quite a complicated VCL (>400 lines).

Thanks for ideas!


@czigor there are a lot of things that could cause shielding to not work properly, especially if you’re just setting things up. Commonly, there may be a return(deliver); or return(pass); statement in your compiled VCL before the shielding logic executes.


I start all my vcl subs with the #FASTLY include. E.g.
sub vcl_recv {
#FASTLY recv
// My logic comes here.
So I guess this should not be a problem. Strangely we still get a surprisingly high hit rate, although the X-Served-By seems to change a lot. Will look into this further.


It might be important to note that for logged-out users we see X-Served-By headers containing two nodes (as it should). (In this case our vcl logic more or less simplifies down to the one of Fastly’s.) There’s always one node in X-Served-By when the user is logged in.


There are things that can be set in the UI that will bypass shielding, so there may be problems there. It’s hard to tell without looking at your service directly. If you’d like, send us an email at and we’ll take a look.


I’ll do that, thanks!