Cloudflare Error 1000: DNS points to prohibited IP
Cloudflare looked up where to send the request and the answer was… Cloudflare. Rather than chase its own tail, the edge stops and shows Error 1000.
What visitors see
Error 1000
DNS points to prohibited IP
It is shown as an ordinary Cloudflare error page with a Ray ID. The site itself may be perfectly healthy; Cloudflare simply refuses to send the request somewhere that leads back to itself.
The classic mistake
When a hostname is proxied (orange cloud), public DNS answers with Cloudflare’s addresses, not yours. If you run dig www.example.com, copy the answer, and paste it into a new A record for example.com, that record now points at Cloudflare. Requests for it would enter Cloudflare, be sent to “the origin”, and arrive at Cloudflare again.
| Record | Value | Result |
|---|---|---|
A example.com | Your server, e.g. 203.0.113.10 | Works |
A example.com | An address you copied from a proxied lookup (a Cloudflare range) | Error 1000 |
CNAME www | example.com (proxied) | Works: a CNAME inside the same zone is fine |
Cloudflare publishes its address ranges at cloudflare.com/ips. If the IP in your record is in one of those ranges, that is your 1000.
The proxy loop
The other common cause is at the origin. A front server receives the request and forwards it with something like:
location / {
proxy_pass https://app.example.com; # also proxied by Cloudflare
}
The forwarded request goes back out to the internet, into Cloudflare, and lands on the same front server. Point proxy_pass at the backend’s private address or 127.0.0.1:PORT instead, or at a hostname that is not proxied.
Cloudflare’s documentation also lists request-header problems under this error, such as an X-Forwarded-For header that is too long or sent twice, or a client setting CF-Connecting-IP itself. Those usually come from a chain of proxies adding to the same header.
Fix checklist
- Open the DNS records for the zone and look at every A and AAAA record that is proxied. Compare each address with your server’s real public IP (on the server,
curl -4 ifconfig.coor your hosting dashboard). - Replace any Cloudflare address with the real origin IP. Use a CNAME if you want one name to follow another.
- If the origin is a reverse proxy, check every
proxy_pass,ProxyPassor load balancer target. It should reach the app directly, not via a public proxied hostname. - Reload the page. DNS changes inside Cloudflare apply quickly because the edge reads the zone directly, so you rarely need to wait for a TTL.
1000 vs its neighbours
| Error | What went wrong |
|---|---|
| 1000 | The origin address is a Cloudflare address, so the request would loop |
| 1001 | Cloudflare does not know this hostname at all, or the CNAME target does not resolve |
| 1016 | The origin hostname you configured has no DNS answer |
| 523 | The origin IP is valid but Cloudflare cannot route to it |
Related
All Cloudflare error codes · Cloudflare Error 1001 · Cloudflare Error 1016 · ERR_TOO_MANY_REDIRECTS · 502 Bad Gateway · What is this? detector
Questions
What does Cloudflare error 1000 mean?
The address Cloudflare would send the request to is itself a Cloudflare address, so it would loop. Usually an A record points at a Cloudflare IP instead of your real server.
How did a Cloudflare IP end up in my DNS?
Most often it was copied from a lookup of a proxied hostname, which only ever shows Cloudflare addresses. Use your server's real public IP instead.
Can a reverse proxy cause error 1000?
Yes. If nginx or another proxy at the origin forwards the request to a hostname that is also proxied by Cloudflare, the request goes round again. Forward to the app directly.
Is error 1000 a visitor problem?
No. Only the site owner can fix the DNS record or proxy setting.
Do I need to wait for DNS to update after fixing it?
Usually not long. Cloudflare's edge reads the zone directly, so a corrected record normally takes effect within a minute or two.
Published .