Frequently Asked Questions about Delivery Optimization

There are many different Delivery Optimization settings available. These settings allow you to effectively manage how Delivery Optimization is used within your environment with controls on bandwidth, time of day, etc.

Yes. Devices obtain the update payloads from the WSUS server, but must also have an internet connection as they communicate with the Delivery Optimization cloud service for coordination.

Delivery Optimization only starts when an application or service that's integrated with Delivery Optimization starts a download. For example, the Microsoft Edge browser. For more information about Delivery Optimization callers, see Types of download content supported by Delivery Optimization.

When Delivery Optimization downloads from a Microsoft Connected Cache server that is hosted by your internet service provider, the download will be pulled directly from the IP address of that server. If the Microsoft Connected cache isn't available, the download will fall back seamlessly to the CDN instead. Delivery Optimization Peers are used in parallel if available.

Delivery Optimization is an HTTP downloader used by most content providers from Microsoft. When a device is configured to use Delivery Optimization peering (on by default), it does so with the HTTP downloader capabilities to optimize bandwidth usage. If you'd like to disable peer-to-peer capabilities of Delivery Optimization, change the Delivery Optimization Download mode setting to '0', which will disable peer-to-peer and provide hash checks. Download mode set to '99' should only be used when the device is offline and doesn't have internet access. Don't set Download mode to '100' (Bypass), which can cause some content to fail to download. Starting in Windows 11, Download mode '100' is deprecated.

Delivery Optimization listens on port 7680 for requests from other peers by using TCP/IP. The service registers and opens this port on the device. The port must be set to accept inbound traffic through your firewall. If you don't allow inbound traffic over port 7680, you can't use the peer-to-peer functionality of Delivery Optimization. However, devices can still successfully download by using HTTP or HTTPS traffic over port 80 (such as for default Windows Update data).

Delivery Optimization uses Teredo to create peer groups, which include devices across NATs (or any form of internal subnet that uses gateways or firewalls between subnets). To enable this scenario, you must allow inbound TCP/IP traffic over port 3544. Look for a "NAT traversal" setting in your firewall to set this up.

Delivery Optimization also communicates with its cloud service by using HTTP/HTTPS over port 80.

For Delivery Optimization to successfully use the proxy, you should set up the proxy by using Windows proxy settings or Internet Explorer proxy settings. For details see Using a proxy with Delivery Optimization. Most content downloaded with Delivery Optimization uses byte range requests. Make sure your proxy allows byte range requests. For more information, see Proxy requirements for Windows Update.

For communication between clients and the Delivery Optimization cloud service:

• *.prod.do.dsp.mp.microsoft.com

For Delivery Optimization metadata:

• *.dl.delivery.mp.microsoft.com

For the payloads (optional):

• *.windowsupdate.com

For group peers across multiple NATs (Teredo):

• win1910.ipv6.microsoft.com

For more information, see Endpoints for Delivery Optimization and Microsoft Connected Cache for a list of all content endpoints needed.

Microsoft content, such as Windows updates, are hosted and delivered globally via Content Delivery Networks (CDNs) and Microsoft Connected Cache (MCC) servers, which are hosted within Internet Service Provider (ISP) networks. The network of CDNs and MCCs allows Microsoft to reach the scale required to meet the demand of the Windows user base. Given this delivery infrastructure changes dynamically, providing an exhaustive list of IPs and keeping it up to date isn't feasible.

The recommended configuration for Delivery Optimization peer-to-peer to work most efficiently along with cloud proxy solutions (for example, Zscaler) is to allow traffic to the Delivery Optimization services to go directly to the internet and not through the cloud proxy. At a minimum, the following FQDN that is used for communication between clients and the Delivery Optimization service should be allowed with direct internet access and bypass the cloud proxy service:

• *.prod.do.dsp.mp.microsoft.com

If allowing direct internet access isn't an option, try using Group Download Mode '2' to define the peering group. Learn more about using Group Download mode.

Delivery Optimization uses the cache content on the device to determine what's available for peering. For the upload source device, there's a limited number (4) of slots for cached content that's available for peering at a given time. Delivery Optimization contains logic that rotates the cached content in those slots.

No. It relies on the cloud service for peer discovery, resulting in a list of peers and their IP addresses. Client devices then connect to their peers to obtain download files over TCP/IP.

Starting in Windows 10, version 1903, Delivery Optimization uses LEDBAT to relieve such congestion. For more information, see this post on the Networking Blog.

Delivery Optimization attempts to identify VPNs by checking the network adapter type and details. A connection is treated as a VPN if the adapter description contains certain keywords, such as "VPN" or "secure."

If the connection is identified as a VPN, Delivery Optimization suspends uploads to other peers. However, you can allow uploads over a VPN by using the Enable peer caching while the device connects via VPN policy.

If you have defined a boundary group in Microsoft Configuration Manager for VPN IP ranges, you can set the DownloadMode policy to 0 for that boundary group, to ensure that there's no peer-to-peer activity over the VPN. When the device isn't connected using a VPN, it can still use peer-to-peer with the default of LAN.

With split tunneling, make sure to allow direct access to these endpoints:

Delivery Optimization service endpoint:

• https://*.prod.do.dsp.mp.microsoft.com

Delivery Optimization metadata:

• http://download.windowsupdate.com
• http://*.dl.delivery.mp.microsoft.com

Windows Update and Microsoft Store backend services and Windows Update and Microsoft Store payloads

• http://*.windowsupdate.com
• https://*.delivery.mp.microsoft.com
• https://*.update.microsoft.com
• https://tsfe.trafficshaping.dsp.mp.microsoft.com

For more information about remote work if you're using Configuration Manager, see this post on the Configuration Manager blog.

Starting with Windows 10, version 1903 or later, Delivery Optimization no longer restricts connections between LAN peers to those using private IP addresses. If you use public IP addresses instead of private IP addresses, you can use Delivery Optimization in LAN mode.

Delivery Optimization is used by most content providers from Microsoft. A complete list can be found here. Often customers may not realize the vast application of Delivery Optimization and how it's used across different apps. Content providers have the option to run downloads in the foreground or background. It's good to check any apps running in the background to see what is running. Also note that depending on the app, closing the app may not necessarily stop the download.