< HTTP/1.1 523 Origin Is Unreachable

TL;DR: Cloudflare has no working network path to your origin IP. Check that the DNS record in Cloudflare points to a public, current address (not 10.x, 172.16-31.x or 192.168.x) and that your host’s routing or CDN-facing network is healthy.

What it means

523 means Cloudflare could not route to the IP your DNS record resolves to. Unlike 522, where Cloudflare reaches the network and waits, here the destination cannot be reached at all, so the error is usually quick. Typical causes:

• The A/AAAA record holds a private (RFC 1918) address or a stale IP after a migration.
• The record is an IPv6 address the origin network does not route to Cloudflare.
• A routing or BGP problem at the hosting provider, or an ISP outage.
• The origin is behind a tunnel or load balancer that was deleted.

Who sent it?

server: cloudflare, a cf-ray header and the page “Origin is unreachable”. Your servers see nothing.

Fix it

1. Check what Cloudflare resolves. In the dashboard, DNS, confirm the record for the hostname (and any CNAME target) is correct and proxied only if intended.

   dig +short example.com @1.1.1.1      # proxied records show Cloudflare IPs
   dig +short origin.example.com        # an unproxied record shows the origin IP

2. Reject private addresses. Public Cloudflare cannot reach 192.168.1.10. Use a public IP or Cloudflare Tunnel (cloudflared) for origins that have none.

3. Test the IP directly from outside your network:

   ping -c 3 203.0.113.10
   mtr -rwc 20 203.0.113.10
   curl -sv --resolve example.com:443:203.0.113.10 https://example.com/ -o /dev/null

4. Check AAAA records. An AAAA record pointing at an unreachable IPv6 address breaks Cloudflare’s IPv6 path even though IPv4 works. Remove it or fix the origin’s IPv6.

5. Contact the hosting provider if traceroutes die inside their network; check their status page for outages.

6. Cloud load balancers. Verify the ALB/ELB, Elastic IP or forwarding rule still exists and the subnet route table has an internet gateway.

523 vs the others

Code	Meaning
521	Reached the host; connection refused
522	Reached the network; no reply (timeout)
523	No route to the origin IP at all
530	Cloudflare error response with an error 1xxx code in the body (for example 1016 Origin DNS error)

For 530 and 1xxx codes the number shown in the page body, such as “Error 1016”, is the one to look up in Cloudflare’s documentation.

Related

• 521 Web Server Is Down
• 522 Connection Timed Out
• 524 A Timeout Occurred
• 520 Web Server Returned an Unknown Error
• 530 Origin DNS Error