Routing your traffic through a reverse proxy is the right way to defend against DDoS — but it rests on one fragile assumption: that attackers cannot find your real server. The whole model works because the world resolves your domain to the proxy, so attacks hit the proxy instead of your origin. The moment an attacker learns your origin's real IP address, they can aim straight at it and bypass the proxy entirely. Origin-IP hygiene is the most overlooked step in DDoS defence, and the one that most often quietly defeats it.
Where Your IP Leaks
- Historical DNS records: services like SecurityTrails archive every IP your domain has ever pointed to. If your server was live before you added the proxy, your old IP is sitting in a database.
- Subdomains: mail., dev., ftp., cpanel. and staging hosts often still resolve straight to the origin even after the main domain is proxied.
- Email headers: mail your server sends can carry its real IP in the headers; check your SPF and MX setup.
- TLS certificates: certificates issued to your origin before the proxy can appear in public Certificate Transparency logs.
- Third-party services and analytics: some resolve and log the addresses of servers they connect to.
- Application errors: stack traces, debug output and error pages that leak server metadata or internal addresses.
One leak undoes everything
It does not matter how good your protection is if the attacker can skip it. A single exposed subdomain or a stale DNS record in an archive is all it takes to route an attack straight at your origin. Origin privacy is not optional hardening — it is a precondition for the proxy working at all.
The Reliable Fix: Rotate and Re-Hide
The dependable solution after moving behind a proxy is to change your origin server's IP address — ask your hosting provider for a fresh one — and then make sure the new address never appears in any public record. Point every subdomain through the proxy or at addresses that are not your origin, fix mail so it does not leak the server IP, and lock your origin's firewall to accept traffic only from the proxy, so even a discovered IP cannot be connected to directly.
How Akarguard Helps You Check
Origin privacy is something you have to get right regardless of provider, so Akarguard's guidance during setup walks you through the leak vectors above: what to look for in DNS history and Certificate Transparency logs, which subdomains to re-point, how to stop mail from exposing the server, and why to rotate the IP and firewall the origin to the proxy. The panel gives you the edge address to point at and the DNS steps to follow. The check itself is straightforward once you know where to look — and doing it before an attacker does is what keeps the proxy in front of your server rather than beside it.