Error 530 (Cloudflare): Read the 1xxx Code Inside

Problem

Cloudflare is serving your visitors an Error 530 page. The number looks like a standard HTTP 5xx, so you go hunting for a broken server — and find nothing wrong with it. That’s because 530 is not the error. It’s Cloudflare’s wrapper around a different error code, and the real one is sitting in the page, one line down, in a format you might have skimmed past.

Symptoms

• Visitors see a Cloudflare error page reading Error 530 with a Ray ID.
• Just below “530,” the page shows a second code in the 1xxx range — often 1016 Origin DNS Error — labeled as the origin-side problem.
• Your origin server itself is up. SSH works, the app runs, logs are quiet. Nothing on the box is erroring.
• It often starts right after a DNS change, a host migration, or an expired/removed record — not after a code deploy.

What 530 Actually Means

Cloudflare sits between the visitor and your origin. When something breaks on Cloudflare’s own attempt to reach your origin, it can’t return your server’s response (there isn’t one), so it generates an error page. The visitor-facing HTTP status on that page is 530, but Cloudflare stuffs the specific reason into the body as a 1xxx code. The 530 is the envelope. The 1xxx is the letter.

This is the whole trick, and missing it wastes hours: 530 by itself is not diagnosable. Two sites both showing “Error 530” can have completely unrelated problems, because the 530 is just Cloudflare saying “I hit one of my 1xxx conditions.” You cannot fix a 530. You fix the 1xxx it’s carrying.

By far the most common passenger is 1016, Origin DNS Error — Cloudflare could not resolve your origin hostname to an IP address. Notice what that means: the request died before Cloudflare ever tried to connect to your server. It never got an address to dial. That’s why the box looks perfectly healthy — nothing ever reached it.

Other 1xxx codes ride inside 530 too: a Worker throwing (1101), a Worker over its resource limits (1102), a cross-user CNAME ban (1014), and more. The decoding step is identical every time: read the number under the 530, then look that number up. DechoNet has dedicated guides for the common ones (1016 origin DNS, 1101/1102 Workers, 1014 CNAME) — this guide is the map that gets you to the right one.

How to Read the Real Error

Open the error page and find the second code. Cloudflare prints it plainly:

Error 530
...
Host Error
origin.example.com
1016

That 1016 is your actual diagnosis. If you only have the 530 from a monitoring alert with no page body, reproduce it with curl -sv https://yourdomain.example/ and read the response — Cloudflare includes the code in the returned HTML. Then take the 1xxx number, not the 530, into the fix.

Top 3 Causes (of the common 530/1016)

1. A missing origin A record - Your Cloudflare DNS has no A/AAAA record giving Cloudflare an IP to proxy to, so hostname resolution fails at the edge. Common after someone deletes or edits a record without realizing it was the origin pointer.
2. A CNAME pointing to a dead target - The origin is a CNAME to an external hostname (a load balancer, a SaaS host, a previous provider) that no longer resolves. You moved hosts, the old target’s DNS was torn down, and the CNAME now points at nothing. Cloudflare tries to resolve the target, gets NXDOMAIN, and returns 530/1016.
3. Unresolvable load-balancer pool origins - If you use Cloudflare Load Balancing, an origin hostname in your default, region, or fallback pool that no longer resolves produces the same 1016 — even while your DNS records for the zone look fine.

Diagnose with DechoNet

• DNS Lookup on your origin hostname — the actual target Cloudflare is trying to reach, not the proxied www name. If the origin is a CNAME, resolve that target. If DNS Lookup returns no A record or an NXDOMAIN for the origin target, you’ve reproduced Cloudflare’s 1016 from the outside, and you know the fix is a DNS record, not a server.
• Confirm the split: a healthy origin box plus a failing origin-hostname lookup is the signature of 530/1016. The problem is name resolution, upstream of any server config.

Resolution Checklist

• Read the 1xxx code, not the 530. Everything below depends on which one you have; the 530 alone can’t tell you.
• For 1016: check that your Cloudflare DNS has a valid A/AAAA record (or a CNAME to a target that resolves) for the origin. Run a DNS Lookup on that exact target to confirm it returns an address.
• After a host move, re-point or recreate the origin record. A CNAME whose target’s DNS was deleted is the classic 1016 — repoint it to the new origin, or switch to an A record if you control the IP.
• If you use Cloudflare Load Balancing, verify every pool origin (default, region, fallback) still resolves. One dead pool member surfaces as 530/1016.
• For a non-1016 code, jump to that error’s guide — 530 wrapping 1101/1102 is a Worker problem, 1014 is a cross-user CNAME, and the fixes are entirely different.

When to Escalate

• If the origin record and its target both resolve cleanly but Cloudflare still returns 530/1016, escalate with your Ray ID to Cloudflare support — a persistent resolution failure on a valid record is theirs to investigate, not yours.
• If the wrapped code is 1101 or 1102, this is a Cloudflare Workers problem, not DNS — escalate to whoever owns the Worker, and use wrangler tail to catch the exception or resource limit behind it.