How to Fix Cloudflare Error 1016 (Origin DNS Error)
What Error 1016 means
Error 1016 is Cloudflare telling you that the last mile of the journey is broken. Your request arrived at Cloudflare fine, Cloudflare opened its DNS zone for your domain and found the record for the origin — but when it tried to resolve that record into an actual server IP, the lookup failed. A CNAME pointed at a hostname that no longer exists, an A record pointed at an address that cannot be reached, or the DNS chain behind the origin collapsed. With nowhere to send the request, Cloudflare shows the 1016 page.
The practical difference from its sibling errors matters: a 1001 means the record is missing from the Cloudflare zone, a 1000 means the record points at a prohibited IP, while a 1016 means the record exists but dead-ends at resolution. That makes 1016 a detective error — the fix is almost always a single DNS edit, but you have to find which hop of the chain is broken first. Like all origin-side Cloudflare errors, visitors cannot fix it; the repair belongs to the site owner or their hosting provider.
Common causes
- CNAME pointing at a dead hostname: the target was renamed, retired, or typed with an error — the single most common cause of a 1016.
- A record with a private or wrong IP: pointing at 127.0.0.1, a 10.x.x.x address, or a server that was decommissioned after a migration.
- Broken DNSSEC chain: a stale DS record at the registrar fails validation, so resolvers (including Cloudflare's) cannot resolve the origin at all.
- Expired or suspended domain: a domain on registrar hold or past expiry breaks the whole DNS chain; no record edit in Cloudflare can fix that.
- Nameserver migration in progress: the domain was moved between DNS providers and the origin zone at the new provider is empty or not yet live.
How to fix Error 1016 — step by step
Step 1 is for visitors. Steps 2 through 6 are for site owners.
- Visitor: confirm the site is really unreachable everywhere. Try the site on mobile data instead of Wi-Fi and in a second browser. If Error 1016 shows everywhere, the origin's DNS is genuinely broken on the site's side — clearing your browser cache, restarting your router, or flushing your own DNS will not help, because the failure happens between Cloudflare and the site's own hosting. Use an alternative route for now and let the site owner know.
- Site owner: resolve the origin hostname yourself. Find the origin record in Cloudflare under DNS, then Records — usually an A record with a server IP or a CNAME pointing at your host. Run the hostname through an independent DNS checker such as dnschecker.org, or use your terminal with dig or nslookup against a public resolver like 8.8.8.8. If the hostname returns NXDOMAIN or no answer, you have found the failure: Cloudflare cannot turn that name into an IP either, which is exactly what the 1016 page means.
- Site owner: repair the broken CNAME target. The classic 1016 cause is a CNAME pointing at a hostname that no longer exists — an old host alias, a retired server name, or a target with a typo. Open DNS, then Records in Cloudflare, click the record, and read the target character by character. If the target was a service your host renamed, replace it with the current hostname from your hosting account. Prefer a direct A record to the server's IPv4 address where your plan allows it, since that removes the extra lookup hop entirely.
- Site owner: make sure the record points at a real, routable IP. An A record that points at 127.0.0.1, 10.x.x.x, 192.168.x.x, or any other private address can never be reached from the internet, and Cloudflare reports that failure as a 1016. Paste the IP into your hosting panel and confirm it is the public IPv4 of your server or your host's load balancer. If the host migrated your site to a new server recently, this step alone usually ends the error.
- Site owner: fix the DNSSEC chain or turn it off cleanly. If the domain uses DNSSEC, a stale DS record at the registrar breaks resolution for every resolver — including Cloudflare's — and the symptom is a 1016. Test the chain with a DNSSEC analyzer: if validation fails, either get the current DS record from your DNS provider and update it at the registrar, or remove the DS record entirely to disable DNSSEC, then wait for the change to propagate before retesting.
- Site owner: check domain status, then test with Cloudflare paused. Look up the domain in a WHOIS tool and confirm it is not expired, suspended, or on a registrar hold such as clientHold — a dead domain breaks the whole DNS chain, and no record edit inside Cloudflare will fix that. If the domain is healthy and the 1016 persists, pause Cloudflare from the Overview page (bottom-right), which sends visitors straight to the origin. If the site still fails to resolve, the problem is at the host: open a ticket with the origin's hostname and the dig output from step 2 so they can repair the broken DNS zone.
Did this fix it? Quick checklist
- The origin hostname resolves to a public IP on dnschecker.org
- DNS → Records points at a live A record or a working CNAME target
- DNSSEC validates — or the DS record has been cleanly removed
- The domain is active in WHOIS: not expired, suspended, or on hold
If you are a visitor and the 1016 persists for a day or more, the owner's origin DNS is still broken — keep using the site's app, social pages, or a cached copy, and report the error to the owner through whatever channel you have. If you are an owner and the origin keeps failing to resolve, check whether the host moved your site to a new server: migrated A records are the number-one source of 1016s after hosting changes, and a quick ticket with the dig output from step 2 usually gets it repaired the same day.
Frequently asked questions
What does Cloudflare Error 1016 mean?
Error 1016 (Origin DNS Error) means Cloudflare received your request and knows which server should answer, but its DNS resolver could not resolve that origin server's hostname or IP. The DNS for the website's own hosting is broken somewhere — a dead CNAME target, a bad IP, broken DNSSEC, or an expired domain.
How is Error 1016 different from Error 1001?
Error 1001 means the DNS record is missing from the Cloudflare zone entirely — Cloudflare has no instructions. Error 1016 means the record exists but cannot be resolved to a working address — the instructions point at a dead end. Both are fixed by the site owner, and both are visible to every visitor, but they need different repairs.
Can I fix Error 1016 as a visitor?
No — the broken origin DNS belongs to the site, so only the site owner or their host can repair it. As a visitor you can confirm the outage by testing another network, then reach the site another way (its app, social pages, or a cached copy) and report the error to the owner.
How long does Error 1016 take to clear?
A fixed record usually clears the 1016 within a minute or two, since Cloudflare re-resolves the origin for each request. If it lingers, stale cached lookups are the cause — allow up to a few hours, flush your local DNS, and confirm the repair with an independent DNS checker. A 1016 that never clears means the origin DNS is still broken or the domain itself is down.