Origin Is Unreachable
ActiveHTTP 523 Origin Is Unreachable is a Cloudflare-specific status indicating Cloudflare cannot reach the origin server at all – DNS resolution failed, the IP is unreachable, or the route doesn't exist. Unlike 522 (TCP timeout where a SYN gets no reply), 523 means the connection attempt couldn't even begin.
Description
523 differs from 522 in the failure layer. A 522 means Cloudflare can route to the origin's IP but the TCP handshake times out. A 523 means Cloudflare cannot resolve or route to the origin at all: DNS lookup for the origin hostname returned no result, the origin IP is not routable from Cloudflare's network, or ICMP unreachable was received. The most common causes are: the origin A/AAAA record was deleted or the TTL expired without renewal, the origin IP was deallocated by the cloud provider, or the origin server was shut down and the DNS record no longer points anywhere valid.
Examples
HTTP/1.1 523 Origin Is Unreachable
Server: cloudflare
Content-Type: text/html
CF-RAY: 8a1b2c3d4e5f0000-LHR
<!-- Cloudflare error page: Origin Is Unreachable --># Check what IP Cloudflare is trying to reach
# (Look in Cloudflare dashboard → DNS → check A/AAAA records)
dig +short example.com A
# If empty or wrong IP → root cause found
# Test if origin IP is reachable externally
curl -svo /dev/null --resolve example.com:443:YOUR_ORIGIN_IP https://example.com
# Test raw TCP to origin IP
nc -zv YOUR_ORIGIN_IP 443Edge Cases
- •If using Cloudflare with a custom origin hostname (not a bare IP), DNS resolution of that hostname must succeed from Cloudflare's network – not just from your network.
- •Cloud provider IP reallocation: if an origin EC2/GCE instance is stopped and restarted, the public IP may change. Update Cloudflare DNS records immediately.
- •Cloudflare's health checks are the same network path as production traffic – if 523 appears in health check logs, the origin DNS/routing is broken.
When You'll See This
- →Origin A record deleted or expired from DNS provider
- →Cloud instance terminated without updating Cloudflare DNS
- →Origin IP deallocated by cloud provider on instance restart
- →Origin hostname doesn't resolve (NXDOMAIN) from Cloudflare's resolvers
- →Network route to origin IP no longer exists
Implementation References
| Language | Constant |
|---|---|
| Go | 523 (no standard constant) |
| Node.js | 523 (Cloudflare proprietary – not in http.STATUS_CODES) |
| Python | response.status_code == 523 |
History
Introduced by Cloudflare as part of the 520–527 proprietary error range for reverse proxy edge cases. 523 represents DNS/routing level unreachability, distinguishing it from TCP-level failures (522) and HTTP-level failures (520, 521).
Related Status Codes
Related Headers
FAQ
What is the difference between 523 and 522?
523 means Cloudflare cannot reach the origin's IP address at all – DNS failed, the IP is not routable, or the network path doesn't exist. 522 means the IP is reachable but the TCP handshake timed out (no SYN-ACK returned within 15 seconds). Fix 523 by correcting DNS records and verifying the origin IP exists. Fix 522 by checking firewalls and origin server load.