Cloudflare Error 1016: Origin DNS Error. Why Cloudflare Cannot Find Your Server

"This error indicates that Cloudflare cannot resolve the origin web server's IP address" (Cloudflare: Error 1016). Like all 1xxx codes it appears in the body of Cloudflare's error page, while the HTTP status line carries a regular code: for 1016 that status is 530 (Cloudflare 1xxx errors). Monitoring that records only status codes therefore logs a 530; the 1016 in the page tells you the cause.

The visitor's own DNS worked: their browser resolved your hostname to Cloudflare. The failure is one step further, when Cloudflare tries to turn the target in your DNS record (usually a CNAME) into an IP address. This is why public DNS tools can show your domain resolving perfectly while the site returns 1016.

A quiet variant of the first cause: the target resolves for you because your resolver has it cached, while authoritative DNS already returns NXDOMAIN. Always query a public resolver or the authoritative server directly.

1. Find the record behind the failing hostname in the Cloudflare DNS tab. A proxied record does not reveal its target through public DNS, so read it there or through the API.
2. Resolve the target yourself through public resolvers:

   dig +short app-old.herokuapp.example. @1.1.1.1
   dig app-old.herokuapp.example. @8.8.8.8 | grep -E 'status|ANSWER'
   # ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN

   NXDOMAIN or an empty answer is the 1016 cause. SERVFAIL means the target's own DNS is broken.
3. Follow the whole chain. A CNAME that points to another CNAME fails if any link fails: dig +trace www.example-target.com shows where it breaks.
4. Replace the target: update the CNAME to the platform's current hostname, or switch to an A record with the origin IP.
5. For Load Balancing, check every pool's origin addresses, and keep at least one fallback origin defined by IP so a DNS failure of the others cannot take the site down.
6. For SaaS custom hostnames, check the hostname's status through the API; Cloudflare's docs show the verification error custom hostname does not CNAME to this zone. until it is fixed.

Error 1016 is decided inside Cloudflare, after your browser has already reached it, so nothing you change locally helps: another DNS resolver, a VPN, clearing cookies or a different browser all lead to the same Cloudflare lookup of the same broken origin name. The error page shows a Ray ID; if you can contact the site owner, send it together with the time and the address you opened. Owners usually see 1016 right after they migrate a site off a hosting platform, delete an old app or rename a load balancer, so the outage tends to last until someone edits the DNS record rather than clearing by itself. If only one subdomain of a site fails, that subdomain's record is the one pointing nowhere.

dig +short new-target.example.net @1.1.1.1
# 203.0.113.10
curl -s -o /dev/null -w '%{http_code}\n' https://www.example.com/
# 200

The target must resolve from public resolvers, and the site must return 200 instead of 530. Our DNS lookup queries public DNS and shows every record it returns, which is a quick check of the CNAME target from outside your network.

• NXDOMAIN — the name does not exist
• SERVFAIL — the resolver could not get an answer
• Cloudflare 523 — the IP is known but unreachable
• Cloudflare 520–530 overview — including the 530 status that carries 1016
• CNAME record — how aliases resolve
• Cloudflare 1003 — a Cloudflare IP opened directly instead of the host name