Proudly Canadian 
You go to check your website and instead of your homepage, you get a stark Cloudflare error page: Error 1000 — DNS points to prohibited IP. Your site is completely down, and the error message isn't exactly helpful about what you're supposed to do next.
The good news is that this particular error almost always has a clear, fixable cause. In most cases it comes down to a DNS record pointing to the wrong IP address, either one left over from an old hosting provider, a Cloudflare IP that ended up in your DNS by mistake, or an address that was never valid to begin with.
This guide walks through exactly what Error 1000 means, why it happens, how to find the correct IP address for your server, and how to make sure it doesn't happen again after your next migration.
Quick Fix Summary
- Log into Cloudflare and check your A record under the DNS tab
- Confirm the IP in your A record matches your actual hosting server IP
- Replace any incorrect, old, or Cloudflare-owned IPs with your real server IP
- Save the change and purge your Cloudflare cache
- Wait a few minutes and test your site
What Is Cloudflare Error 1000, Really?
To understand why this error happens, it helps to understand what Cloudflare is actually doing when your site is behind it.
When someone visits your domain, their browser first asks DNS where your domain lives. If your DNS is managed through Cloudflare, the response comes back with a Cloudflare IP address instead of your actual server IP. The visitor's browser connects to Cloudflare, and Cloudflare then forwards the request to your real origin server behind the scenes.
For this to work, Cloudflare needs to know what your real server IP is and that information lives in your DNS A record. Error 1000 fires when Cloudflare looks at that A record and finds an IP address it refuses to connect to as an origin server.
The IP addresses that trigger this error include:
- Other Cloudflare IP addresses (Cloudflare refuses to proxy traffic to itself)
- Loopback addresses like 127.0.0.1
- Private network ranges like 10.x.x.x or 192.168.x.x
- IP addresses from a previous hosting provider that are no longer associated with your account
- Completely invalid or placeholder IPs that were never a real server
This is distinctly different from Error 521 (origin server refused connection) or Error 522 (connection timed out). Those errors mean Cloudflare found an IP and tried to connect but failed. Error 1000 means Cloudflare didn't even attempt the connection because the IP itself is on a prohibited list.
How to Diagnose the Problem Before Making Changes
Before touching anything in your DNS, it's worth spending two minutes diagnosing the actual problem. Blind edits to DNS records can extend downtime if something goes wrong.
Check what IP your domain currently resolves to
The fastest way to see what's in your DNS right now is to use a tool like MXToolbox or simply open a terminal and run:
nslookup yourdomain.com 8.8.8.8
or
dig yourdomain.com @8.8.8.8
This queries Google's public DNS directly and shows you what IP your A record is currently pointing to. If the IP shown belongs to Cloudflare's ranges (you can check at cloudflare.com/ips), that's your problem right there.
Check your Cloudflare DNS tab directly
Log into your Cloudflare dashboard, select your domain, and click the DNS tab. Look at the A records for your root domain and any subdomains (www, mail, etc.). The IP shown in the "Content" column is what Cloudflare is trying to use as your origin. Make note of it before changing anything.
Find your correct server IP
You need to know the right IP before you can fix the wrong one. Here's where to look:
- Your hosting welcome email: When your hosting account was set up, the confirmation email almost always includes your server's IP address.
- cPanel or Plesk: Log into your control panel. The server IP is usually displayed in the account information section or can be found under "Server Information."
- Your client area: Navigate to My Services, click on your hosting package, and look for the server IP in the product details.
- Your host's support team: If you're not sure, just ask. Any hosting provider can tell you the correct IP for your account in seconds.
Step-by-Step Fix
Step 1: Log into Cloudflare
Go to dash.cloudflare.com and sign in. From the home screen, click on the domain that's showing Error 1000.
Step 2: Navigate to the DNS tab
In the left sidebar, click DNS, then select Records. You'll see a list of all DNS records for your domain.
Step 3: Identify the problematic A record
Look for the A record for your root domain (shown as @ or your domain name) and the www subdomain. The "Content" column shows the IP address these records are pointing to. This is the one you need to fix.
If you see an IP that starts with 104., 172.64., 198.41., or similar Cloudflare-owned ranges, that's almost certainly the cause of your Error 1000.
Step 4: Edit the record
Click the Edit button next to the incorrect A record. Replace the IP address in the content field with your actual server IP. Leave the proxy status on (orange cloud) unless you have a specific reason to turn it off, Error 1000 is caused by the wrong IP, not by the proxy itself.
Step 5: Save and repeat
Click Save. If you have multiple A records pointing to the wrong IP (for example, both @ and www), update each one. Don't forget any subdomains that might also be affected.
Step 6: Purge your Cloudflare cache
Even after fixing the DNS record, Cloudflare's cache may serve stale content or error pages. Go to Caching in the left sidebar, click Configuration, then click Purge Everything. This forces Cloudflare to fetch fresh content from your now-corrected origin.
Step 7: Test
Wait two to three minutes and visit your site. Cloudflare DNS changes are usually near-instantaneous on Cloudflare's end. If the site is still down, try visiting from a different device or network to rule out local DNS caching on your machine.
Managing DNS Through Your Client Area
If your domain is registered through us or your DNS is hosted on our nameservers, you may not need to touch Cloudflare's DNS tab at all. Instead, you can update your A records directly from your client portal.
- Log into your client area
- Go to My Domains and click Manage next to the domain in question
- Select DNS Management
- Find the A record for your root domain (@) and update the IP to match your server
If your domain is pointed to Cloudflare's nameservers, then the DNS changes need to happen inside Cloudflare's dashboard as described above, changes in our DNS panel won't take effect while Cloudflare's nameservers are active.
Not sure which nameservers your domain is using? You can check by running whois yourdomain.com or using any WHOIS lookup tool online.
Common Scenarios That Lead to Error 1000
Website migration without updating DNS
This is by far the most common cause we see. A website gets moved to a new server with a different IP address, but the DNS A record still points to the old server. If the old server also happened to be behind Cloudflare, or if the old IP has since been reassigned to Cloudflare infrastructure, you'll hit Error 1000 immediately.
The fix is always the same: update the A record to the new server's IP. The important thing is to do this before decommissioning the old server, or at least have the new IP ready to go in.
Copying DNS records from documentation
Teams setting up a new domain sometimes copy DNS records from internal documentation or a previous project. If those docs contain a Cloudflare IP or a placeholder IP, it gets entered into DNS and causes this exact error. Always verify IPs against your hosting account directly rather than relying on documentation that may be outdated.
Mixing CDN providers
If you were previously using a different CDN or DDoS protection service and switched to Cloudflare, there's a chance the old provider's IP ended up in your DNS records. Each provider uses different IP ranges, and Cloudflare will refuse to proxy to IPs that belong to other CDNs or to itself.
Stale records after a cPanel migration
When you migrate a cPanel account from one server to another, the migration tool copies everything including the DNS zone file. If the zone file contains an A record pointing to the old server IP and you don't update it after the migration, Cloudflare will try to connect to a server you no longer control.
Someone manually entered the wrong IP
It happens. A typo, a copied IP from the wrong server, a record updated by a team member who grabbed the IP from the wrong place. Always double-check IPs against your hosting account information, not from memory or informal sources.
Understanding Cloudflare's Proxy Modes
When you look at your DNS records in Cloudflare, you'll notice each record has a cloud icon next to it that's either orange or grey. This matters for Error 1000.
Orange cloud (proxied): Traffic flows through Cloudflare. Visitors connect to Cloudflare, and Cloudflare forwards requests to your origin IP. This gives you Cloudflare's performance and security features. Error 1000 can only happen on proxied records, because Cloudflare is actively trying to reach your origin.
Grey cloud (DNS only): Cloudflare acts as a plain DNS resolver. Visitors connect directly to your server IP. No Cloudflare features apply. You won't see Error 1000 in this mode because Cloudflare isn't proxying traffic.
If you're trying to quickly test whether your server is reachable while you sort out the IP situation, you can temporarily switch the record to DNS only (grey cloud). This bypasses Cloudflare entirely and lets you confirm the server is actually responding at the IP you've entered.
How to Prevent This From Happening Again
A few habits that will save you from dealing with this error in the future:
- Keep a DNS record log. Maintain a simple document that lists your domain, current A record IP, which server it points to, and when it was last updated. Before any migration, update this document first.
- Update DNS before you migrate, not after. Lower your TTL to 300 seconds a day before the migration, then update the A record to the new IP right as you complete the move. This minimizes downtime and ensures Cloudflare has the correct IP from the moment the new server is live.
- Verify IPs from your hosting panel, not from email or memory. Always pull the server IP directly from your cPanel, Plesk, or client area immediately before updating DNS. IPs can change between server migrations.
- After adding Cloudflare to an existing site, double-check all records. When you first add a domain to Cloudflare, it scans your existing DNS and imports records automatically. Review them carefully, the auto-import isn't always perfect, especially if you've had multiple hosting providers over the years.
When to Contact Support
Most Error 1000 cases are straightforward once you have the correct server IP. But there are situations where the fix isn't as simple:
- You've updated the A record with what you believe is the correct IP, but the error persists
- You're not certain which server IP your site should be pointing to
- You're managing multiple domains across multiple servers and aren't sure which IP belongs to which
- The error appeared after a migration that was handled by a third party and you don't have full visibility into what changed
- You're seeing Error 1000 on some subdomains but not others, suggesting partial DNS misconfiguration
Open a support ticket from your client area and include your domain name and a screenshot of your current Cloudflare DNS records. Our team can identify the correct origin IP for your account and walk you through the fix.
Gotekky
Need help deciding what to do next?
Tell us what you are seeing and what outcome you need. We will identify whether a managed service, scoped project or paid technical assessment is the right next step.