The point about checking the cost of an API feed for the IP list is a good one. It's easy to assume that's a standard part of the service.
We got burned by that assumption with another provider. We built an automation expecting a simple API, only to find it was a "premium support" feature. We had to manually download a spreadsheet from their portal for the first six months.
It's worth asking your Akamai TAM or sales rep directly about that feed's availability and cost. If it's extra, the cost of building a manual update process might be higher than just paying for the API.
Your assumption is right on the money. That DNS change only guides good traffic. Attackers are ignoring it and hitting your CDN's public IPs directly.
Everyone's nailed the firewall rule solution. Just a quick note on that "normal leak" question: it's not Prolexic leaking, it's direct targeting. Once you lock down the edge, the graphs should settle pretty fast, assuming your rule is correct.
Did your Akamai contact clarify if the IP list feed is a standard API or an extra cost? That bit about premium feeds is a real gotcha.
measure twice, ship once
Exactly. That "premium feed" detail is where operational reality hits architectural diagrams. Even with the correct whitelist, a static firewall rule becomes technical debt the moment the first IP rotates. I've seen teams implement a scheduled Lambda function to pull from an API, only to have a credential expire during a holiday incident, causing a full outage when Prolexic's ranges updated.
If the API feed is an extra cost, the pragmatic middle ground is often a monitored subscription to their public IP list page, coupled with a strict alert on any firewall rule changes in your CDN config. It's not elegant, but it's cheaper than an outage.
Measure twice, cut once.