523 Origin Is Unreachable

Routing failures preventing Cloudflare from reaching the origin server produce the 523 Origin Is Unreachable status code.

Table of Contents

Usage
Example
How to fix
See also

Usage

Cloudflare is a content delivery network acting as a reverse proxy between clients and origin servers. The 523 error means Cloudflare cannot contact the origin web server. The typical cause is a network device between Cloudflare and the origin lacking a route to the origin's IP address.

Common causes include:

The DNS records in the Cloudflare dashboard point to an incorrect or outdated IP address.
The origin's hosting provider has changed the server's IP address without updating Cloudflare.
A router or firewall in the origin network has no route to the origin's IP address, or an overly broad route captures Cloudflare's IP ranges.
Network-level routing failures between Cloudflare and the origin.

Example

A client requests a resource through Cloudflare. A network device in the origin's infrastructure has no route to the origin IP, preventing Cloudflare from reaching the origin.

Request

GET /about HTTP/1.1
Host: www.example.re
Accept: text/html

Response

HTTP/1.1 523 Origin Is Unreachable
Date: Sun, 02 Mar 2026 10:30:00 GMT
Content-Type: text/html
Server: cloudflare
CF-RAY: 8a1b2c3d4e5f6-AMS

<html>
<head><title>523 Origin Unreachable</title></head>
<body>
<h1>Error 523</h1>
<p>Origin is unreachable</p>
</body>
</html>

How to fix

Open the Cloudflare DNS settings and confirm every A and AAAA record points to the current origin IP address. A common cause is switching hosting providers or migrating servers without updating the IP in Cloudflare. Remove stale records and add the correct address.

Review routing tables in the origin network for routes swallowing Cloudflare's address space. Cloudflare documents a common case on AWS: a VPC route table entry covering 172.0.0.0/8 captures Cloudflare's 172.64.0.0/13 range and sends return traffic into the private network instead of back to Cloudflare. Narrow the route so Cloudflare's IP ranges remain publicly routable.

When the origin hostname itself fails DNS resolution, Cloudflare returns a 530 with error 1016 rather than a 523. Diagnose missing or broken DNS records under that code.

Port mismatches between the Cloudflare SSL/TLS mode and the origin listener produce a 521 or 522 rather than a 523. Diagnose port and HTTPS configuration under those codes.

Run an MTR or traceroute from the origin server to a Cloudflare IP address (found in origin access logs) to diagnose routing failures. Provide the MTR output and origin server logs to the hosting provider for investigation.