How is 1016 different from 523 Origin Is Unreachable?

They fail at different steps. For 523, Cloudflare has an origin IP address but can't route packets to it — the host is dead, firewalled, or unreachable. For 1016, Cloudflare never gets an IP in the first place: the DNS lookup for the origin hostname failed, so there's no address to even try. 523 is a network-path problem; 1016 is a name-resolution problem one step earlier.

My A record looks fine but I still get 1016. Why?

The usual reason is a proxied CNAME that points to a hostname which no longer resolves. Cloudflare has to follow that CNAME to a real IP, and if the target returns NXDOMAIN — a deleted subdomain, a decommissioned load balancer, a typo — the chain dead-ends and you get 1016. Resolve the CNAME's target directly from the public internet; that's where the break usually is.

Can an internal hostname cause 1016?

Yes, and it's a common self-inflicted one. Cloudflare's edge resolves your origin using public DNS. If a record points to an internal-only name like origin.internal or web01.local, or to a private DNS zone the public internet can't see, the edge can't resolve it and returns 1016. The origin has to be resolvable from outside your network unless you've set up a private-networking path like Cloudflare Tunnel.

Views: 128

Error 1016 Origin DNS Error (Cloudflare): Fix

Error 1016 means Cloudflare can't resolve your origin's IP. Fix in 3 checks: A/AAAA record, CNAME target, origin host. Free instant check, no sign-up.

Check your domain for this issue now

Free, no sign-up. Runs the exact check this guide describes and shows what to fix.

Problem

Cloudflare returns Error 1016: Origin DNS error. A visitor reaches Cloudflare’s edge fine, but Cloudflare can’t turn your origin’s hostname into an IP address, so it has nowhere to forward the request.

Symptoms

The Cloudflare-branded error page shows Error 1016.
It’s usually total and consistent, not intermittent — every request fails the same way.
It appears right after a DNS edit, a host migration, deleting a record, or changing a CNAME target.
The public site is down even though your origin server is up and serving fine on its own IP.

What This Error Actually Means

Cloudflare sits in front of your origin. To proxy a request, it first has to know where your origin lives — it takes the origin hostname configured in your DNS and resolves it to an IP. Error 1016 means that resolution failed. Cloudflare asked “what IP is this origin?” and got no usable answer.

This is the step before connecting. It’s why 1016 is not the same as the 52x family. A 523 means Cloudflare has an IP but can’t reach it. A 521 means the host actively refused the connection. 1016 is earlier and more basic: there is no IP to try, because a DNS record is missing, points at a name that doesn’t resolve, or points somewhere the public internet can’t see.

Almost every real 1016 traces back to a broken record in your Cloudflare DNS or a CNAME that leads to a dead end.

Top 3 Causes

A missing or deleted A/AAAA record for the proxied hostname - The orange-clouded record that should carry your origin’s IP is gone, or was never created after a migration. Cloudflare has a hostname to serve and no address behind it.
A CNAME pointing to a target that no longer resolves - The record is a CNAME to another hostname — a load balancer, a platform subdomain, a third-party service — and that target returns NXDOMAIN. A decommissioned endpoint, a deleted subdomain, or a single typo in the target is enough. Cloudflare follows the CNAME, hits a dead name, and stops.
The origin points to an internal or private name - The record references a hostname only your internal DNS can resolve (web01.local, a private zone, a VPC-internal name). Cloudflare’s edge resolves over public DNS and can’t see it, so the lookup fails from the outside even though it works from inside your network.

Diagnose with DechoNet

DNS Lookup to resolve the exact hostname your Cloudflare origin record points to — and, if it’s a CNAME, to resolve the target of that CNAME from the public internet. If the target returns NXDOMAIN or nothing, you’ve found the 1016: Cloudflare sees the same dead end you do.
HTTP Check to confirm the failure is the Cloudflare 1016 page and not a different origin error, once DNS is fixed and resolving again.

Resolution Checklist

In the Cloudflare dashboard, find the proxied (orange-cloud) record for the affected hostname and confirm it exists and holds the correct value.
If it’s an A/AAAA record, verify the IP is your current origin and that the origin is actually up on that address.
If it’s a CNAME, resolve its target with DNS Lookup. A target that returns NXDOMAIN is the cause — fix the target hostname or repoint the record.
Rule out an internal-only origin name: the origin hostname must resolve from the public internet, or you need Cloudflare Tunnel / a private-networking setup instead of a plain proxied record.
After correcting the record, re-run DNS Lookup to confirm the origin now resolves, then reload the site.

When to Escalate

If the origin record is correct and the target resolves publicly but 1016 persists, escalate to Cloudflare support — the edge may be caching a stale negative lookup, or a zone-level setting is overriding the record.
If the origin lives behind private DNS on purpose, escalate to whoever owns your network to stand up Cloudflare Tunnel rather than exposing an internal name; a plain proxied record can never resolve a private hostname from the edge.