Error guide / Cloudflare Error 1016: Origin DNS error
Cloudflare Error 1016: Origin DNS error
Error 1016 is Cloudflare telling you it accepted the visitor's request but could not find the server it was supposed to hand that request to. The browser reached Cloudflare's edge without trouble, Cloudflare then looked up the origin address behind your DNS record, and that lookup failed. Visitors see a Cloudflare error page with 'Error 1016' and 'Origin DNS error' next to a Ray ID, usually served with HTTP status 530. It is always a server-side fault: nothing a visitor changes on their own device will make the site load.
Check your site
What causes it
The most common cause by a wide margin is a proxied CNAME record in your Cloudflare DNS whose target no longer resolves: the external app was deleted or renamed, the old host dropped that hostname, or the target simply has a typo. Next comes a hostname with no usable record behind it at all, where a CNAME points at nothing and no A or AAAA record exists for that name either. Less often the target is real but its own DNS is broken: its domain expired, its nameservers stopped answering, or its zone was deleted. Rarer still, a Cloudflare Load Balancer origin pool holds an origin hostname that cannot be resolved.
How to fix it
- Open the Cloudflare dashboard, pick the domain, go to DNS then Records, and find the row for the exact hostname shown on the error page (the root domain is @, a subdomain has its own row). Copy the value in the Content or Target column: that is the origin whose address Cloudflare is failing to get.
- Paste that CNAME target, not your public domain, into the DNS check on this page. If it comes back with no A or AAAA records, that is your whole answer: the target does not exist for us either, so Cloudflare cannot resolve it. If an A record does come back, the record works right now, so look at the load balancer or at a hostname other than the one you just tested.
- Do not judge the problem by checking the public domain itself. It is proxied, so a lookup returns Cloudflare's own anycast addresses (104.x, 172.67.x and similar) and tells you nothing about your origin. That check is useful only to confirm the domain really is behind Cloudflare.
- Fix the record to match what you found: correct the typo, point the CNAME at the hostname your current provider actually issues, or replace it with an A record holding your server's IP address. If the service behind that CNAME is gone for good, delete the record instead of leaving it proxied.
- If the target does resolve, run the check on the target's own domain and read its NS records: an empty list, or nameservers that do not answer, means the origin's DNS is broken or the domain has expired, and it has to be fixed with that domain's registrar or DNS host.
- If you use Cloudflare Load Balancing, open the origin pool and check every origin address in it, since a single unresolvable hostname there produces 1016 even when the DNS record looks correct. After any change, wait a minute and reload: Cloudflare applies its own DNS edits quickly, but a repaired external hostname can stay cached for as long as its TTL says.