# 523 Origin Is Unreachable

> Cloudflare-specific error when the origin server's IP address is unreachable. Learn about DNS and routing issues causing 523 errors.

Source: https://howhttpworks.com/status-codes/523
Last reviewed: 2026-10-04

> **TL;DR:** Cloudflare has no working network path to your origin IP. Check that the DNS record in Cloudflare points to a public, current address (not 10.x, 172.16-31.x or 192.168.x) and that your host's routing or CDN-facing network is healthy.

## What it means

523 means Cloudflare could not route to the IP your DNS record resolves to. Unlike [522](https://howhttpworks.com/status-codes/522), where Cloudflare reaches the network and waits, here the destination cannot be reached at all, so the error is usually quick. Typical causes:

- The A/AAAA record holds a private (RFC 1918) address or a stale IP after a migration.
- The record is an IPv6 address the origin network does not route to Cloudflare.
- A routing or BGP problem at the hosting provider, or an ISP outage.
- The origin is behind a tunnel or load balancer that was deleted.

## Who sent it?

`server: cloudflare`, a `cf-ray` header and the page "Origin is unreachable". Your servers see nothing.

## Fix it

1. **Check what Cloudflare resolves.** In the dashboard, DNS, confirm the record for the hostname (and any CNAME target) is correct and proxied only if intended.

   ```bash
   dig +short example.com @1.1.1.1      # proxied records show Cloudflare IPs
   dig +short origin.example.com        # an unproxied record shows the origin IP
   ```

2. **Reject private addresses.** Public Cloudflare cannot reach `192.168.1.10`. Use a public IP or Cloudflare Tunnel (`cloudflared`) for origins that have none.
3. **Test the IP directly** from outside your network:

   ```bash
   ping -c 3 203.0.113.10
   mtr -rwc 20 203.0.113.10
   curl -sv --resolve example.com:443:203.0.113.10 https://example.com/ -o /dev/null
   ```

4. **Check AAAA records.** An AAAA record pointing at an unreachable IPv6 address breaks Cloudflare's IPv6 path even though IPv4 works. Remove it or fix the origin's IPv6.
5. **Contact the hosting provider** if traceroutes die inside their network; check their status page for outages.
6. **Cloud load balancers.** Verify the ALB/ELB, Elastic IP or forwarding rule still exists and the subnet route table has an internet gateway.

## 523 vs the others

| Code | Meaning                                         |
| ---- | ----------------------------------------------- |
| 521  | Reached the host; connection refused            |
| 522  | Reached the network; no reply (timeout)         |
| 523  | No route to the origin IP at all                |
| 530  | Cloudflare error response with an error 1xxx code in the body (for example 1016 Origin DNS error) |

For 530 and 1xxx codes the number shown in the page body, such as "Error 1016", is the one to look up in Cloudflare's documentation.

## Related

- [521 Web Server Is Down](https://howhttpworks.com/status-codes/521)
- [522 Connection Timed Out](https://howhttpworks.com/status-codes/522)
- [524 A Timeout Occurred](https://howhttpworks.com/status-codes/524)
- [520 Web Server Returned an Unknown Error](https://howhttpworks.com/status-codes/520)
- [530 Origin DNS Error](https://howhttpworks.com/status-codes/530)