How is Error 1001 different from Error 1016 Origin DNS Error?

They fail at opposite ends of the request. Error 1016 happens after Cloudflare knows which zone you belong to — it just can't resolve your origin's hostname into an IP to forward the request to. Error 1001 happens before that: a request reached a Cloudflare IP, but Cloudflare can't map the hostname in the Host header to any active zone or record it serves. 1016 is 'I know who you are but can't find your backend.' 1001 is 'I don't know who this request is even for.'

I removed my domain from Cloudflare but visitors still get 1001. Why?

Because your domain's DNS still points at Cloudflare's anycast IPs. When you move a domain off Cloudflare, the nameserver change has to propagate and any A/AAAA records pointing at Cloudflare IP ranges (104.16.0.0/13, 172.64.0.0/13, and others) have to be repointed at a real origin. Until then, requests keep landing on Cloudflare's edge for a hostname it no longer serves, and the edge answers 1001. Repoint the records at your actual server and wait out the TTL.

The domain works but one subdomain throws 1001. What's missing?

That subdomain almost certainly has no DNS record in your Cloudflare zone. Cloudflare serves each hostname from a record you create — an A, AAAA, or CNAME. If shop.example.com resolves to a Cloudflare IP (usually because of a wildcard or a stale entry) but you never added a record for shop, the edge receives the request, finds nothing to route it to, and returns 1001. Add the missing A/AAAA/CNAME for that exact hostname.

Views: 17

Error 1001 DNS Resolution Error (Cloudflare): Fix

Error 1001 means Cloudflare can't map the requested hostname to a zone. Fix in 3 checks: the DNS record, a dangling Cloudflare IP, propagation. Free instant check, no sign-up.

Check your domain for this issue now

Free, no sign-up. Runs the exact check this guide describes and shows what to fix.

Problem

A visitor hits your site and Cloudflare answers with Error 1001: DNS resolution error. This is not your origin server failing, and it is not the visitor’s browser. The request made it all the way to Cloudflare’s edge — and then Cloudflare looked at the hostname being requested, went to find which of its zones should handle it, and came up empty. The edge is holding a request addressed to a name it doesn’t serve. That’s the whole error: the packet arrived, but there’s nobody home for that hostname.

Symptoms

The Cloudflare-branded interstitial reads Error 1001 with the label DNS resolution error.
It affects the specific hostname, not necessarily the whole domain — the apex can work while a subdomain fails, or vice versa.
It often appears right after a DNS change: adding a domain to Cloudflare, removing one, or repointing records.
The origin server logs show nothing, because the request never reached the origin. It died at the edge.

What This Error Actually Means

Every request to Cloudflare’s anycast network lands on one of its edge IPs, and the edge uses the Host header (or SNI) to decide which customer zone the request belongs to. Error 1001 is what you get when that lookup fails: the hostname doesn’t map to an active record in any Cloudflare zone the edge can see.

The important distinction is against 1016 Origin DNS Error. With 1016, Cloudflare has already matched you to a zone and is trying to resolve your origin’s hostname (the backend a CNAME points to) — that’s a second, downstream lookup. With 1001, the first lookup — “whose request is this?” — is the one that failed. It fails one step earlier, before Cloudflare ever thinks about your origin.

Top 3 Causes

A DNS record points at Cloudflare, but no zone serves that hostname - The classic case. A stale A/AAAA record (often left behind by a wildcard, a migration, or a subdomain you forgot) resolves to a Cloudflare anycast IP, but there’s no matching record inside a Cloudflare zone. The edge receives the request and has nothing to route it to.
A domain in mid-transition - You just added the domain to Cloudflare and it hasn’t finished provisioning, or you just removed it and the nameserver/record change hasn’t propagated. During that window, requests reach Cloudflare for a hostname it isn’t (yet, or any longer) authoritative for.
A cross-account CNAME - An external domain (not on Cloudflare, or on a different account) has a CNAME pointing at a hostname that is active on Cloudflare. The request arrives at the edge carrying the external Host header, which maps to no zone the edge serves. (If the target requires Cloudflare for SaaS, this shows up as 1001 or 1014 depending on setup.)

Diagnose with DechoNet

DNS Check resolves the failing hostname and shows exactly what it points to. If the A/AAAA answer is a Cloudflare anycast IP (104.16.x.x / 172.64.x.x and neighbors) but the page throws 1001, you’ve confirmed the record points at Cloudflare with no zone behind it. If it’s a CNAME, follow the target — a dangling or cross-account target is your culprit.
HTTP Check confirms the error is served by Cloudflare’s edge (look for the cf-ray header and the 1001 body) rather than by your origin, which pins the failure to the edge lookup and rules out an origin-side problem.

Resolution Checklist

In DNS Check, confirm what the failing hostname resolves to. A Cloudflare anycast IP with a 1001 page means the record exists but no zone serves it.
In your Cloudflare dashboard, verify there is an A, AAAA, or CNAME record for the exact hostname that’s failing — apex, www, and each subdomain are separate records. Add the missing one, pointing at your real origin IP or backend.
If you recently added the domain, confirm the zone status is Active (not Pending) and that your registrar’s nameservers match the pair Cloudflare assigned. A Pending zone can’t serve records.
If you recently removed the domain from Cloudflare, repoint every A/AAAA record away from Cloudflare IP ranges to your actual server, and wait out the record’s TTL for caches to expire.
For a CNAME to another provider, resolve the target end-to-end. If it lands on a different Cloudflare account’s hostname, you need Cloudflare for SaaS on the target side or an A record at your origin instead.
Re-run DNS Check and HTTP Check until the hostname resolves to your origin and the 1001 page is gone.

When to Escalate

If the record is correct, the zone is Active, the nameservers match, and 1001 persists past the record’s TTL, open a ticket with Cloudflare and include the cf-ray value from the error page — that ID lets their support trace which lookup failed at the edge.
If the failing hostname belongs to a SaaS platform you don’t control (a CNAME into a vendor’s Cloudflare setup), the fix is on the vendor’s side — they need to provision your custom hostname. Send them the exact hostname and the cf-ray.
If 1001 flickers on and off during a migration, that’s propagation, not a misconfiguration. Confirm the new records are correct and let the old TTLs expire rather than changing settings repeatedly.