Cloudflare Error 1016: Origin DNS error
Cloudflare is proxying your hostname, but when it looks up the origin server name you configured, DNS comes back empty or broken — so the edge has nowhere to send the request.
What visitors see
Error 1016
Origin DNS error
You've requested a page on a website that is on the Cloudflare network.
The host name resolved to an IP that is blocked by Cloudflare or that
does not resolve to an origin (Error 1016).
Cloudflare Ray ID: …Only orange-cloud (proxied) hostnames show this page. Grey-cloud DNS never asks Cloudflare to look up an origin, so 1016 is an edge-proxy problem, not “the whole internet cannot resolve your domain.”
1016 vs 523 vs NXDOMAIN vs 522
| Symptom | What failed | Typical cause |
|---|---|---|
| Error 1016 | CF cannot resolve the origin hostname | Missing/wrong A/AAAA/CNAME for the origin target; typo in Load Balancer / Origin Rule |
| Error 523 | Origin IP is known but unroutable | BGP blackhole, dead IP, private address published publicly |
| DNS_PROBE_FINISHED_NXDOMAIN | Visitor DNS for the site name fails | No public A/AAAA/CNAME for the hostname they typed |
| ERR_NAME_NOT_RESOLVED / getaddrinfo ENOTFOUND | Client DNS lookup failed | Same family as NXDOMAIN for browsers/Node |
| Error 522 | Origin IP resolved; TCP connect timed out | Firewall DROP, wrong port, host down |
| Error 521 | TCP refused at origin | Nothing listening / wrong port |
Rule of thumb: 1016 = “Cloudflare does not know an IP for the origin name.” 523 = “Cloudflare has an IP but cannot route to it.” NXDOMAIN on the visitor side = “the public hostname itself is missing.”
Frequent real causes
- CNAME flattening / missing target —
wwwCNAMEs toorigin.example.com, butorigin.example.comhas no A/AAAA (or the record was deleted after a server move). - Origin hostname typo — Load Balancer pool, Origin Rule, or Workers route points at
app.exmaple.com. - Only a private / internal name — origin set to something that resolves on your office DNS but not on the public internet Cloudflare queries.
- Stale DNS after a migration — old provider still authoritative for a subdomain; new A record never published where Cloudflare looks.
- IPv6-only origin with broken AAAA — rare, but a bad AAAA and no A can leave the edge with nothing usable.
- “DNS only” record expected to be the origin — proxied record points at another proxied Cloudflare hostname in a loop, or at a name Cloudflare will not resolve as origin.
Diagnose in five minutes
- In Cloudflare → DNS, note the orange-cloud hostname visitors use and the target (IP or hostname) it points at.
- If the target is a hostname, resolve it from a public resolver:
Empty answers → that is your 1016.dig +short origin.example.com A dig +short origin.example.com AAAA # or nslookup origin.example.com 1.1.1.1 - Check Load Balancing pools / Origin Rules / Workers routes for a hostname override that differs from the DNS tab.
- Confirm the origin name is not a private split-horizon name. Cloudflare’s resolvers only see public DNS.
- After fixing, wait for TTL (or purge / lower TTL first). Hit the site again; Ray ID on a fresh 1016 means the edge still cannot resolve.
Fixes that usually work
- Create a correct public A or AAAA for the origin hostname (or change the proxied record to point straight at the origin IP).
- If you use a CNAME chain, every hop must resolve publicly until an IP appears.
- Correct typos in Load Balancer / Origin Rule hostnames; save and re-test.
- For migrations, publish the new origin record before switching the proxied name, with a short TTL.
- Do not “fix” SSL mode or pause Cloudflare as the first step — that hides the DNS problem instead of fixing the origin name.
Quick checks from the origin side
# Does the name the dashboard uses resolve publicly?
dig +short YOUR_ORIGIN_HOSTNAME @1.1.1.1
# Once it resolves, can something listen?
curl -sI --max-time 5 http://ORIGIN_IP/
# Then re-check the proxied hostname:
curl -sI --max-time 10 https://www.example.com/
Related
Cloudflare Error 1001 · Cloudflare Error 1000 · All Cloudflare error codes · Cloudflare Error 523 · DNS_PROBE_FINISHED_NXDOMAIN · ERR_NAME_NOT_RESOLVED · getaddrinfo ENOTFOUND · Cloudflare Error 522 · Cloudflare Error 521 · Cloudflare Error 1020 · Anvil HTTP status · Anvil URL inspect
Questions
What does Cloudflare Error 1016 mean?
Cloudflare could not resolve the origin hostname configured for your proxied site to an IP address, so the edge has nowhere to send the request.
How is 1016 different from 523?
1016 is a DNS failure looking up the origin name. 523 means Cloudflare already has an origin IP but cannot route to it on the network.
Why can I resolve the site on my laptop but still see 1016?
Your laptop may be using private/split-horizon DNS. Cloudflare’s resolvers only see public DNS for the origin hostname.
Is 1016 the same as DNS_PROBE_FINISHED_NXDOMAIN?
No. NXDOMAIN usually means the visitor cannot resolve the public hostname. 1016 means visitors reached Cloudflare, but Cloudflare cannot resolve the origin target behind it.
Can a Load Balancer pool cause 1016?
Yes. If a pool or Origin Rule points at a hostname that does not resolve publicly, the edge returns 1016 even when the DNS tab looks fine.
Should I pause Cloudflare to fix 1016?
No as a first step. Fix or publish the origin A/AAAA/CNAME (or correct the origin hostname), then re-test the orange-cloud name.
How do I confirm the fix?
dig/nslookup the origin hostname via 1.1.1.1 until an IP appears, then curl the proxied HTTPS hostname and check you no longer get Error 1016.
Published · updated .