◆Error Codes Wiki

HTTP 523 Origin Is Unreachable — Cloudflare Cannot Resolve Origin DNS

Critical5xx server error

Overview

Fix Cloudflare HTTP 523 error when the origin server's IP address cannot be resolved or routed to from Cloudflare's network.

Key Details

  • HTTP 523 means Cloudflare cannot reach the origin server because DNS resolution failed or the IP is unroutable
  • This differs from 521 (connection refused) — 523 means the server address itself cannot be found
  • Common after DNS changes, server migrations, or when the origin IP changes
  • Can also occur if the origin server's IP is in a private range not accessible from the internet
  • Cloudflare caches DNS records so changes may take time to propagate

Common Causes

  • DNS A/AAAA record pointing to an incorrect or decommissioned IP address
  • Origin server IP changed after migration without updating Cloudflare DNS records
  • Origin IP is in a private subnet (10.x, 172.16.x, 192.168.x) unreachable from the internet
  • Network routing issues between Cloudflare's data centers and the origin server

Steps

  1. 1Verify the origin IP in Cloudflare DNS settings matches your actual server IP
  2. 2Ping the origin IP from an external location to confirm it is publicly reachable
  3. 3If you recently migrated servers, update the A record in Cloudflare to the new IP
  4. 4Check that the origin server has a valid public IP and is not behind a NAT without port forwarding
  5. 5Purge Cloudflare cache and wait a few minutes for DNS propagation after making changes

Tags

cloudflare523dnsunreachableorigin

Related Items

http-521-web-server-is-down-cloudflare

More in 5xx Server Error

http-500-internal-server-errorHTTP 500 Internal Server Error — What It Means & How to Fix It
Critical
http-501-not-implementedHTTP 501 Not Implemented — What It Means & How to Fix It
Critical
http-502-bad-gatewayHTTP 502 Bad Gateway — What It Means & How to Fix It
Critical
http-503-service-unavailableHTTP 503 Service Unavailable — What It Means & How to Fix It
Critical
http-504-gateway-timeoutHTTP 504 Gateway Timeout — What It Means & How to Fix It
Critical
http-505-http-version-not-supportedHTTP 505 HTTP Version Not Supported — What It Means & How to Fix It
Critical

Frequently Asked Questions

521 means the connection was actively refused (server is there but not accepting). 523 means the server cannot be found at all — DNS resolution failed or the IP is not routable.