If you are working with complicated sites with CDNs, especially with imagecache whereby because Drupal says to replace the domain with a CDN domain, the URL called is not Drupal and so never generates the image, then heres the solution. I use varnish as well so am able to say "if the image returns a 404 error, try fetching it from original Drupal domain"

Basically it says, if the request was to the CDN and it was an image or css or js file, if we get an 404 error then change the request domain to my drupal domain and call varnish back.