523 Origin Is Unreachable

Routing failures preventing Cloudflare from reaching the origin server produce the 523 Origin Is Unreachable status code.

Table of Contents

Usage

Cloudflare is a content delivery network acting as a reverse proxy between clients and origin servers. The 523 error means Cloudflare cannot contact the origin web server. The typical cause is a network device between Cloudflare and the origin lacking a route to the origin's IP address.

Common causes include:

  • The DNS records in the Cloudflare dashboard point to an incorrect or outdated IP address.
  • The origin's hosting provider has changed the server's IP address without updating Cloudflare.
  • A router or firewall in the origin network has no route to the origin's IP address, or an overly broad route captures Cloudflare's IP ranges.
  • Network-level routing failures between Cloudflare and the origin.

Note

A 523 differs from 522 Connection Timed Out in a key way: a 522 means the origin never answered the TCP handshake within the connection window, while a 523 means no route to the origin IP exists. When Cloudflare is unable to resolve the origin hostname through DNS, it returns 530 with error 1016 instead.

SEO impact

Search engines treat Cloudflare 523 responses as server errors. Persistent 523 errors reduce crawl rate and prevent indexing of affected URLs. Correcting the origin DNS or routing restores normal crawling.

Example

A client requests a resource through Cloudflare. A network device in the origin's infrastructure has no route to the origin IP, preventing Cloudflare from reaching the origin.

Request

GET /about HTTP/1.1
Host: www.example.re
Accept: text/html

Response

HTTP/1.1 523 Origin Is Unreachable
Date: Sun, 02 Mar 2026 10:30:00 GMT
Content-Type: text/html
Server: cloudflare
CF-RAY: 8a1b2c3d4e5f6-AMS

<html>
<head><title>523 Origin Unreachable</title></head>
<body>
<h1>Error 523</h1>
<p>Origin is unreachable</p>
</body>
</html>

How to fix

Open the Cloudflare DNS settings and confirm every A and AAAA record points to the current origin IP address. A common cause is switching hosting providers or migrating servers without updating the IP in Cloudflare. Remove stale records and add the correct address.

Review routing tables in the origin network for routes swallowing Cloudflare's address space. Cloudflare documents a common case on AWS: a VPC route table entry covering 172.0.0.0/8 captures Cloudflare's 172.64.0.0/13 range and sends return traffic into the private network instead of back to Cloudflare. Narrow the route so Cloudflare's IP ranges remain publicly routable.

When the origin hostname itself fails DNS resolution, Cloudflare returns a 530 with error 1016 rather than a 523. Diagnose missing or broken DNS records under that code.

Port mismatches between the Cloudflare SSL/TLS mode and the origin listener produce a 521 or 522 rather than a 523. Diagnose port and HTTPS configuration under those codes.

Run an MTR or traceroute from the origin server to a Cloudflare IP address (found in origin access logs) to diagnose routing failures. Provide the MTR output and origin server logs to the hosting provider for investigation.

See also

Last updated: August 11, 2026