If you host XAP files on a CDN or other host (such as Amazon S3), you need to have the server configured with the new Silverlight MIME type. You can find out specifics in the breaking changes reference.

When you do not need to configure the MIME type:

• If your .Xap files and web pages are on the same domain and do not need to be embedded elsewhere
• If you use a service like Silverlight Streaming and just embed <iframe /> tags in your web site

But, if you want to share or enable embedding for others, you need to add the "application/x-silverlight-app" MIME type for your .Xap files.

This will allow:

• You to host your application binaries with a CDN
• Others to embed your applications in their pages and sites
• Bloggers to embed Silverlight <object /> tags right in their content and let syndication services and news readers embed the content

Equally important, if you don't want others to directly link to and reference your .Xap from their domains, then make sure to not send this mime type.

Apache
For global configuration, in your central mime.types file, add:

# Enable Silverlight support for our apps to be embedded anywhere
application/x-silverlight-app        xap

Then restart Apache:

$ sudo ./apachectl restart

If you're just configuring at the directory level, edit or add the .htaccess file in the directory you want to serve anywhere, and add the line:

AddType application/x-silverlight-app xap

IIS 6 & 7
Here's a nice step-by-step guide to adding the MIME type on Windows web servers.

Amazon S3
Maybe not a true CDN, I do use Amazon's Simple Storage Service (S3) for most of my Silverlight application hosting.

Amazon S3 records the MIME type that your S3 client sends with each file upload. This means that you must configure your system with the appropriate "application/x-silverlight-app" MIME type when you upload, or when clients download your .Xap, they will get an unknown MIME type and be greeted with blank space where you'd expect your app to be working.

Your CDN
I do not know the current Limelight or Akamai stories, sorry! Feel free to post a comment if you know.

Use Fiddler to check

I'd highly recommend that you download and use Fiddler2 on your Windows system. Using it, you can make sure and see what the content type is when it comes back in an HTTP response.