How to Fix Cloudflare Error 1000 (DNS Points to Prohibited IP)

By ErrorFix · Updated October 19, 2026 · 6 min read

What Error 1000 means

Cloudflare's 1xxx error family covers DNS and proxy configuration problems, and Error 1000 is the one that says "DNS points to prohibited IP." It means the domain's DNS record resolves to an IP address inside Cloudflare's own network — and Cloudflare is not allowed to use its own addresses as the origin server. Since Cloudflare cannot proxy a request to itself, it serves the Error 1000 page instead of your website.

This is purely a configuration mistake, and it lives entirely in the site's DNS settings. Nothing about your computer, browser, or internet connection causes it, and nothing on the visitor's side can resolve it. The page is only ever shown for domains that are already on Cloudflare — which is why the fix always belongs to the site owner or their hosting provider. It is also worth distinguishing 1000 from its close relatives: Error 1001 means Cloudflare has no DNS record for the domain at all, while Error 1003 appears when someone visits the site through its raw IP address.

Common causes

• Using 1.1.1.1 as the server's address: the most common trigger. 1.1.1.1 is Cloudflare's famous public DNS resolver, and site owners sometimes mistake it for a Cloudflare server address and put it in their A record. Cloudflare sees a request aimed at its own resolver IP and refuses it.
• A record pointing into Cloudflare's network ranges: any IP inside Cloudflare's published ranges (for example 104.16.0.0/12 or 172.64.0.0/13) is prohibited as an origin. This often happens when DNS entries are copied from another Cloudflare-proxied site during a migration — the copied IP was a proxied frontend address, not the real server.
• DNS migration or copy-paste errors: moving a site between hosts or rebuilding DNS records by hand and accidentally carrying over a Cloudflare frontend IP from the old setup, so the new zone points at the wrong place from day one.
• A CNAME pointing at a Cloudflare-proxied hostname: using another site's Cloudflare-proxied domain as the origin target. The CNAME resolves to a Cloudflare IP, and Cloudflare declines to connect to itself.
• A wildcard record catching everything: a wildcard (*) A record set to a Cloudflare IP routes every hostname on the domain — including ones that were never configured — straight into the prohibited address, producing Error 1000 on subdomains that should not even exist.

How to fix Error 1000 — step by step

Steps 1 through 5 are for the site owner. Step 6 is for visitors.

1. Recognize that Error 1000 is an owner-side DNS problem. Error 1000 is served by Cloudflare only for domains already using Cloudflare, and it means the site's own DNS configuration is broken. No browser setting, VPN, or device change can fix it — only the site owner (or their hosting provider) can correct the DNS record. Visitors should skip to step 6; the middle steps are for the site owner.
2. Site owner: open the domain's DNS records in Cloudflare. Log in to the Cloudflare dashboard, select the domain, then go to DNS, then Records. Look at the A and AAAA records, especially the apex (@) record and the www record. One of them has an IP address value that is the problem — note which records exist before changing anything, so you can undo a mistake.
3. Site owner: find the record pointing at a prohibited Cloudflare IP. Check each record's target IP against Cloudflare's published IP ranges. The classic culprit is 1.1.1.1 — Cloudflare's public DNS resolver, which people mistakenly use as their server's address. Other common culprits are any IPs inside Cloudflare's network ranges, such as 104.16.0.0/12 or 172.64.0.0/13, often copied over from a different Cloudflare-proxied site during a migration. The offending record is the one you must fix.
4. Site owner: replace the bad record with your origin server's real IP. Find your server's true IP address in your hosting provider's control panel — the shared IP in cPanel, the main IP on a VPS, or the value your host lists under DNS or server information. Edit the offending DNS record in Cloudflare: change its content to that origin IP, leave the proxy status (orange cloud) enabled, and save. Do the same for any other A or AAAA records that point at prohibited IPs, including wildcard records if one is set.
5. Site owner: verify propagation, then purge the Cloudflare cache. DNS changes take minutes to a few hours to propagate worldwide. Check with an online DNS checker that queries from multiple locations: the domain should now resolve to your origin server's IP, not a Cloudflare IP. Once that looks right everywhere, go to Caching, then Configuration in the Cloudflare dashboard and click Purge Everything — this clears any cached copies of the Error 1000 page so visitors see the fixed site immediately instead of a stale error.
6. Visitor: report it to the owner and retry later. As a visitor you cannot fix Error 1000 — the broken setting lives in the site owner's DNS. Reload the page once to rule out a cached error, then reach the owner through their other channels: social media accounts, a contact email, or their support system. Tell them you are seeing Cloudflare Error 1000, which means their DNS points at a prohibited IP — that phrase tells them exactly what to fix. Try the site again after a few hours; once the owner corrects the record and the cache is purged, the site loads normally.

Did this fix it? Quick checklist

• The A and AAAA records point to the origin server's real IP, not any Cloudflare-owned IP
• No wildcard (*) record routes traffic into a prohibited address
• A global DNS check shows the domain resolving to the origin IP from multiple locations
• After purging the Cloudflare cache, visitors load the site instead of the Error 1000 page

If you are the owner and the error persists after the records look right, double-check for a second offending record you missed — apex and www are often configured separately, and a leftover wildcard can keep catching traffic. Also confirm you edited the DNS zone that is actually active for the domain: if nameservers still point at the old host or registrar, your Cloudflare edits change nothing until the nameserver switch completes.