Cloudflare 523: your origin server can’t be reached

Error 523: Origin Is Unreachable means Cloudflare couldn’t find a network path to your origin server at all. The server didn’t refuse (521) or answer too slowly (522); Cloudflare’s connection attempt simply had nowhere to go.

What Cloudflare means by 523

Cloudflare’s documentation on 5xx errors says 523 occurs when Cloudflare can’t contact your origin, typically because a network device between Cloudflare and the origin has no route to the origin’s IP address. In practice that’s almost always one of two things: the IP in your DNS is wrong, or the network around your server is broken.

Common causes

• Outdated DNS after a move. You migrated hosts, the old server is gone, and the proxied A record in Cloudflare still points at its address.
• A wrong or private IP in the DNS record, such as an internal 10.x or 192.168.x address.
• A broken AAAA record. If you publish an IPv6 address the server doesn’t actually answer on, Cloudflare may try it and fail even though IPv4 works.
• Routing problems at your hosting provider or its upstream network.

SEO impact

A 523 usually takes down every page on the hostname, and Googlebot sees a server error on each one. Google’s documentation says crawling slows on 5xx errors and URLs that keep failing are removed from the index. Because the fix is often a single DNS record, it’s also one of the quickest outages to resolve, so act on it immediately.

How to fix a 523

1. Get the correct origin IP from your hosting control panel or provider.
2. Compare it with Cloudflare DNS and fix every proxied A and AAAA record (root, www, subdomains). Delete AAAA records your server doesn’t answer on.
3. Test the origin directly with the commands below, from a machine outside your hosting network.
4. If the route breaks inside your provider’s network, send them the traceroute; it’s theirs to fix.

# does the origin answer at that IP?
curl -sv --resolve www.example.com:443:203.0.113.10 \
  https://www.example.com/ -o /dev/null

# where does the route break?
mtr -rwzc 50 -T -P 443 203.0.113.10

A public DNS lookup of a proxied hostname shows Cloudflare’s addresses, not your origin’s, so check the origin IP in the Cloudflare dashboard itself. The DNS glossary entry covers record types if you need a refresher.

How to check

After updating DNS, run the site’s main URLs through the HTTP status checker and confirm you get 200s across the board. If the error persists, the HTTP header checker shows the cf-ray value Cloudflare support will ask for.

HTTP/2 523
date: Fri, 30 Oct 2026 11:14:45 GMT
content-type: text/html; charset=UTF-8
server: cloudflare
cf-ray: 8d2f6a1f3c8e2b55-LHR

Frequently asked questions