Cloudflare Error 1016 "Origin DNS Error": Causes and Fixes

Error 1016 means Cloudflare accepted the visitor's request but could not work out where your origin server is, because the DNS record for the origin did not resolve to an IP address. Cloudflare's documentation describes it as a failure to resolve the origin web server's IP address. This is different from the 52x errors, where Cloudflare found the origin but could not talk to it properly; here the lookup itself failed.

You see a Cloudflare-branded page with "Error 1016: Origin DNS error", and a Ray ID. It may be returned with an HTTP 530 status, since Cloudflare uses 530 as a wrapper for 1xxx errors; see Cloudflare 520 to 526 errors.

Causes, most likely first

According to Cloudflare's documentation, the typical causes are:

1. No A or AAAA record for the hostname in your Cloudflare DNS, so there is no origin IP.
2. A CNAME that points at a name that does not resolve, for example a deleted hosting app, a typo, an expired domain or a provider hostname that changed.
3. Load Balancer pools whose origin hostnames do not resolve.
4. Spectrum applications with a CNAME origin that lacks a matching DNS record in Cloudflare.
5. Partial (CNAME) setups, where Workers subrequests need DNS records that exist in the Cloudflare zone.
6. SSL for SaaS (custom hostnames) issues, such as incomplete ownership validation, a missing or misconfigured fallback origin, a wildcard custom hostname conflicting with a standalone zone, or a missing DNS record in the SaaS target zone.

Step 1: check what the record points to

Open the Cloudflare dashboard for the domain, go to DNS, and find the record for the hostname on the error page. Note its type and target. Then query the target the way Cloudflare would:

dig +short A origin.example.com
dig +short AAAA origin.example.com
dig +short CNAME www.example.com
dig A target-app.example-host.com

No answer or an NXDOMAIN status means the name does not resolve, and that is the cause. The DNS Checker shows the same answers from several locations, and the Nameserver Lookup confirms that the domain is really delegated to Cloudflare, since editing records at another DNS provider has no effect if the nameservers differ.

Step 2: fix the record

Missing A record. Add one pointing to your server's public IPv4 address (get it from your host's panel):

CNAME target does not resolve. Either correct the target to the current hostname given by your provider, or replace the CNAME with an A record to a known IP. If the target belonged to a service you cancelled, remove the record or reconnect the service. A target that was released can also be claimed by someone else, which is a security risk; see subdomain takeover and dangling DNS and run the Dangling DNS Checker.

CNAME chains. A CNAME target must itself end in an address record. If it points to another hostname in your own zone, that hostname needs an A or AAAA record.

Load Balancer. Open the pool, check each origin's hostname or IP, and fix any hostname that does not resolve.

Spectrum. For a CNAME origin, make sure the hostname exists as a DNS record in your Cloudflare zone.

Workers and Partial setup. If a Worker calls fetch() on a hostname, ensure that hostname exists in your Cloudflare zone's DNS. In a Partial (CNAME) setup, add the needed records inside Cloudflare.

Step 3: if you use SSL for SaaS

For a custom hostname showing 1016:

1. Check the custom hostname status through the dashboard or API; it should be active. Complete any pending ownership and certificate validation.
2. Confirm the fallback origin is set and itself resolves (it needs a proxied DNS record in the SaaS provider's zone).
3. If a wildcard custom hostname conflicts with a separate Cloudflare zone for the same domain, add specific hostnames as individual custom hostnames instead of relying on the wildcard.
4. Make sure the target hostname in the SaaS zone has a DNS record.

Step 4: wait for caches and retest

DNS changes inside Cloudflare take effect quickly, but a CNAME target that you just fixed at an external provider may be cached by resolvers for its TTL; see TTL explained. For a broader view of propagation, read how long DNS propagation takes.

How to verify

Load the site in a private window. The Cloudflare error page should be replaced by your site. Use the Cloudflare Error Checker to confirm the error is gone and the DNS Checker to confirm the record resolves consistently. The Website Hosting Checker helps you confirm which host the origin actually is, and the CDN Detector verifies that traffic still flows through Cloudflare.

Next steps

• Check your records with the DNS Checker.
• Find leftover records with the Dangling DNS Checker.
• Read Cloudflare setup, DNS and SSL modes.
• Review DNS records cheat sheet.

FAQ

Is error 1016 a server problem?

No. It is a DNS problem. Cloudflare could not find an IP address for your origin, so it never tried to connect.

Why do I see 530 instead of 1016?

Cloudflare returns the 1xxx code on the page and uses HTTP status 530 as the wrapper. The 1016 code is the one that tells you the cause.

I deleted a hosting account. Could that cause it?

Yes. If your CNAME pointed at the host's default hostname and that name no longer resolves, Cloudflare reports 1016. Point the record somewhere valid or remove it.

Does turning the proxy off fix it?

Not by itself, because the record still has to resolve. Unproxied, visitors would instead see a normal DNS failure. Fix the record's target.

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.