Error guide

523 Origin Is Unreachable

Cloudflare could not route to your origin at all — usually a DNS record pointing at nothing.

523 means Cloudflare could not reach your origin at all: it could not route to the address, or the address does not correspond to a reachable host. This is a level below 521 and 522, both of which imply Cloudflare at least knew where to go and tried.

The dominant cause is a DNS record pointing at the wrong place. A server was rebuilt and got a new IP, a migration finished but the record was never updated, or the record was typed with a digit transposed. From Cloudflare's side these are indistinguishable: it has an address, and there is nothing there.

It can also mean the origin hostname does not resolve at all, which happens when Cloudflare's record points at another hostname rather than at an address and that name's own DNS has expired, been deleted, or moved. The other recurring case is an origin record holding a private address: it is a perfectly valid address, it is simply not one anything on the internet can route to, so Cloudflare reports the same unreachable result.

Common causes

  • A DNS A or AAAA record pointing at an address that no longer exists or was never right.
  • An origin server decommissioned or rebuilt with a new address.
  • A CNAME chain where an intermediate name no longer resolves.
  • An origin address inside a private range that Cloudflare cannot route to from the internet.
  • A registrar or DNS provider problem affecting the origin's own resolution.

How to diagnose it

  1. Check what the origin record actually points at and confirm that address is live.
  2. Resolve the origin hostname yourself if Cloudflare points at a name rather than an address.
  3. Confirm the address is publicly routable — a private address in an origin record produces exactly this.
  4. Attempt a connection to that address and port from any external host.
  5. Check whether the record was changed recently, which is the most common trigger.

Whose fault is it? The server's side

A configuration problem on your side: the record and the reality disagree. Cloudflare is reporting truthfully that there is nothing at the address it was given.

What monitoring sees

A monitor on the public hostname sees the 523 as an HTTP response and records it. The distinction from 521 and 522 is worth keeping in the check history, because it separates a routing or DNS error from a refused or silent origin — three different first steps.

Related error guides

Terms used on this page

Questions

What causes a 523 error?

Nearly always a DNS record pointing at an address that is not there — after a rebuild, a migration, or a typo. Cloudflare has an address and nothing answers at it.

How is 523 different from 522?

522 means Cloudflare reached the network path and got no reply before timing out. 523 means it could not route to the origin at all, which usually means the address itself is wrong.

One of the Uptimely HTTP and network error guides, written for the person who operates the server rather than the one refreshing the page. Something here read wrong to you? Email support@getuptimely.com.