If you are working with complicated sites with CDNs, especially with imagecache whereby because Drupal says to replace the domain with a CDN domain, the URL called is not Drupal and so never generates the image, then heres the solution. I use varnish as well so am able to say "if the image returns a 404 error, try fetching it from original Drupal domain"
if (req.url ~ "\.(png|gif|jpg|swf|css|js)$" && req.http.host ~ "^mycdn\.domain\.com" && beresp.status == 404 ) {
set req.http.Host = "mydrupal.domain.com";
return(restart);
}