How to Fix Cloudflare Error 1002 (DNS Points to Prohibited IP)

By ErrorFix · Updated October 20, 2026 · 6 min read

What Error 1002 means

Error 1002 is Cloudflare's way of saying "I know where your DNS wants me to go, but I'm not allowed to go there." When a visitor requests your site, Cloudflare reads the DNS record for the hostname — usually an A record holding an IPv4 address — and tries to forward the request to that address. If the address is on Cloudflare's prohibited list, it stops right there and shows the 1002 page. Nothing ever reaches your server, so no server-side fix can help; the wrong value is in the DNS record itself.

Two kinds of address land on that prohibited list. The first is Cloudflare's own edge IPs: if your A record points at, say, a 104.16.x.x or 172.64.x.x address, you have created a loop — the traffic would go into Cloudflare and right back into Cloudflare, forever. The second is private and reserved addresses: 127.0.0.1 (localhost), the 10.x.x.x, 192.168.x.x, and 172.16.x.x–172.31.x.x private ranges, and 0.0.0.0. Those only work inside a local network, so Cloudflare on the public internet can never reach them. The fix in every case is the same: point the record at your origin server's real, public IP address.

Common causes

• A record points at a Cloudflare edge IP: someone pinged the (proxied) domain, got a Cloudflare address back, and pasted it into the A record as if it were the server — creating a loop.
• Record points at localhost or a private IP: 127.0.0.1, 192.168.x.x, 10.x.x.x, or 0.0.0.0 ended up in the zone — common after copy-paste mistakes or dev-environment configs.
• Stale IP from a migration: the server moved hosts, the old IP was retired, and the remaining record now resolves to an address Cloudflare reserves or cannot route.
• CNAME chain ends at a bad address: the hostname points at another service's hostname, which itself resolves to a Cloudflare edge IP or a private range.
• Wrong value taken from a CDN dashboard: an IP copied from a different CDN's control panel was pasted into the Cloudflare zone instead of the origin server's real IP.

How to fix Error 1002 — step by step

Step 1 is for visitors. Steps 2 through 6 are for site owners.

1. Visitor: confirm the site is down for everyone, not just you. Try the site on mobile data and in a private browser window, and check it on an uptime tool such as downdetector or isitdownrightnow. Error 1002 is always a site-side DNS configuration problem — clearing your browser cache, restarting your router, or switching DNS servers on your own device will not clear it. If the error shows up everywhere, note it and skip to the alternatives; the fix belongs to the site owner.
2. Site owner: find the record that points at the bad IP. Log in to Cloudflare, select the domain, and go to DNS, then Records. Look at the A (and AAAA) record for the exact hostname showing Error 1002. Write down the IP address it points to. That address is the whole story — Cloudflare refuses to proxy it because it falls on its prohibited list, so this record is what you will replace.
3. Site owner: confirm the IP is actually prohibited. Compare the address from the record against the two usual suspects. Cloudflare's own edge IP ranges (for example 104.16.0.0/13, 172.64.0.0/13, 173.245.48.0/20, 108.162.192.0/18, 141.101.64.0/18, 190.93.240.0/20, 198.41.128.0/17) are prohibited because pointing a record at Cloudflare itself creates a loop. Private and reserved addresses are also prohibited: 127.0.0.1 (localhost), 10.x.x.x, 192.168.x.x, 172.16.x.x through 172.31.x.x, and 0.0.0.0. If your record points at any of these, you have found the cause.
4. Site owner: replace the record with your origin server's real public IP. Get the true public IP of your hosting server or origin from your hosting control panel — not from a CDN dashboard, and not from a ping of the domain (that returns a Cloudflare edge IP). Edit the A record in Cloudflare and paste the real server IP in the IPv4 address field. Keep the proxy status orange-clouded so traffic still passes through Cloudflare's protection on the way to the correct destination.
5. Site owner: check for CNAME chains that resolve to a bad IP. If the hostname uses a CNAME instead of an A record, the target of that CNAME may itself resolve to a prohibited address — a common trap when pointing at another service's hostname that is itself behind Cloudflare. Run a DNS lookup on the CNAME target and follow the chain to the final IP. If the final IP is a Cloudflare edge address or a private range, point the record directly at your origin's public IP with an A record instead.
6. Site owner: verify the fix and purge the Cloudflare cache. Look up the hostname with an independent DNS checker such as dnschecker.org and confirm it now resolves to your origin's public IP, not a Cloudflare or private address. Then, in the Cloudflare dashboard, go to Caching, then Configuration, then Purge Everything, so no stale edge response keeps serving the 1002 page. Reload the site in a private window — the error should be gone within minutes, and at most a few hours if a cached negative lookup lingers on your network.

Did this fix it? Quick checklist

• The hostname loads in a private window with no 1002 page
• The A record holds your origin server's real public IP, not a Cloudflare or private address
• Any CNAME chains resolve end-to-end to a public, routable IP
• The Cloudflare cache was purged after the record change

If you are a visitor and the 1002 persists for a day or more, the owner's DNS fix is stuck — try the site's app, its social pages, or a web-cache copy in the meantime, and report the error to the owner through whatever contact channel you have. If you are an owner and the error survives a correct record, double-check that you edited the active Cloudflare account and zone: a domain claimed by two accounts, or a zone edited on a deactivated domain, will keep serving the old record no matter what you change.