What's 'akamai', and why is my firewall alerting me about it?

First off, I have to assume you really mean "a1255.g.akamai.net". Here's why I say that:

• "a1255.g.akamai" is an invalid domain name, simply because ".akamai" is an invalid top level domain (TLD). Top level domains are things like ".com", ".net", or country codes like ".ca", ".nl" and so on.

• My first guess, "a1255.g.akamai.com" doesn't resolve. If, in a command prompt, I attempt to:

  ping a1255.g.akamai.com

  I get the error message "Ping request could not find host a1255.g.akamai.com. Please check the name and try again."

• My second guess, "a1255.g.akamai.net", resolved properly. The ping command responded with actual ping results.

So now, armed with a working domain name, I attempted to find out who owns the "second level" domain, "akamai.net".

My first attempt is to use a "Whois" service to look up the owner of the domain. I typically start with betterwhois.com, which in this case tells me that the registrar (not the owner) is Tucows.com, and that I need to visit them to get more details.

I visit Tucows domain help site which includes their whois look-up. Entering "akamai.net" tells me what I wanted to know: the owner is a company called, not surprisingly, "Akamai Technologies".

So that didn't help much, did it? We still don't know what Akamai does.

To me that means it's time for Google. Searching on "akamai" returns not only the company home page (akamai.com), but also an interesting Wikipedia article on Akamai. In there we learn that "Akamai Technologies ... provides, among other services, global Internet content caching." And in one of the references cited in that article, "Theory of how Akamai works", we learn that there's actually a structure to the domain name - the "a1255" and the "g" probably mean something specific - though we're not quite sure what.

So what's all that mean? What's this "Internet content caching" thing?

To grossly oversimplify, it's a form of web hosting that "spreads the load" across other servers. For example, a business might use akamai to host all of it's images, so as to reduce load on their own servers. The akamai servers might optimize for providing images, and only images, very quickly. For busy sites, this type of load balancing, or more correctly, load spreading, allows several computers, servers and infrastructure to cooperate in such a way as to present web pages as quickly as possible.

While I'm not as busy as sites that use akamai, I use a similar technique here at Ask Leo! If you download any of my podcasts, while the URL you initially see begins with "http://ask-leo.com/podcasts/...", that's redirected, and the actual download occurs from a completely different server: "http://media.pugetsoundsoftware.com/ask-leo.com/podcasts/...". This actually distributes the bandwidth of the larger MP3 downloads to a completely different server. That "media" server is acting in many ways like the Akamai service we've just discussed.

Now... why is Zone Alarm tripping on it? I have no idea. You didn't say whether the block was outgoing or incoming. I can't envision a reason for an incoming connection from an akamai server, so blocking that makes sense. But my assumption is that you're seeing an outgoing block. Since so many companies use Akamai services I'm not sure at all why that might be blocked, unless the specific customer represented by "a1255.g" is something or someone that Zone Alarm has determined may be harmful.

I'd be tempted to follow that question through with Zone Alarm.