Cloudflare error 1000 means the origin address for your hostname is Cloudflare itself. The proxy will not forward a request back into its own network, so it halts and returns DNS points to prohibited IP rather than looping.
The error page carries a Ray ID and one line of text, which makes the Cloudflare 1000 error look more mysterious than it is. Everything behind it comes down to a single rule: when Cloudflare proxies a hostname, it needs somewhere outside Cloudflare to send the request. If the address it ends up with is one of its own, or if the request looks like it has already been round-tripped through the proxy, it stops.
What the proxy is refusing to do
A proxied record — the orange cloud — answers DNS queries with Cloudflare anycast addresses, so visitors connect to Cloudflare first. Cloudflare then looks up where to forward the request: the value stored in your A, AAAA, or CNAME record. If that value is also a Cloudflare address, the request would arrive back at the same proxy it just left, and do so again on the next hop. Rather than let that run, Cloudflare treats the address as prohibited and answers the visitor directly. If proxied versus DNS only is new to you, start with what the orange cloud means in Cloudflare.
The same reasoning covers cases where the DNS record is fine but the request itself carries evidence of a previous trip through the proxy. That is why the fix is not always in the DNS tab.
The five ways to get there
Cloudflare lists the causes flat. Sorting them by where the loop is is more useful, because it also tells you who can fix it.
| Where the loop is | What it looks like | Who fixes it |
|---|---|---|
| In the record | An A record holds a Cloudflare address, or a load balancer origin points at a proxied record | You, in DNS |
| At the origin server | A reverse proxy there forwards to your public hostname, which resolves to Cloudflare again | You or your host, in the server config |
| In the request headers | An over-long or duplicated X-Forwarded-For, or a client-supplied CF-Connecting-IP | Whoever sits in front of Cloudflare |
| In the TLS handshake | The SNI the origin is offered does not match what it expects | You or your host, at the origin |
| On a SaaS platform | Your domain points at a provider whose addresses are announced through Cloudflare | The provider |
1. The record points into Cloudflare
By far the most common cause, and the one people arrive at this page with. An A record for the hostname contains an address from Cloudflare’s published IP ranges instead of the server’s. It usually happens when someone copies the address a lookup returned for the live site — which, on a proxied hostname, is Cloudflare’s — and pastes it back into the record. In Cloudflare’s wording that is a prohibited IP address: correct for a visitor to reach, wrong for the proxy to forward to. Ask your hosting provider for the origin’s real address and replace the value.
The load balancing variant is the same mistake one level up: an origin inside a load balancer pool is set to a hostname that is itself proxied, so resolving the pool member lands on Cloudflare. Point pool origins at addresses or at DNS-only hostnames.
2. A reverse proxy at the origin sends it back
Your record is correct, the request reaches your server, and then nginx — or any similar reverse proxy — forwards it onward to the public hostname with something like proxy_pass https://www.example.com. That hostname resolves to Cloudflare, so the request re-enters the proxy from the origin side. Cloudflare’s guidance here is to stop proxying and use an HTTP redirect at the origin instead, or to have the proxy talk to an internal address that does not resolve through Cloudflare.
3. The request arrives with proxy headers already set
Three header conditions produce error 1000 on their own:
- An
X-Forwarded-Forheader longer than 100 characters. - Two
X-Forwarded-Forheaders in one request. - A
CF-Connecting-IPheader present on the inbound request. Cloudflare sets that header itself on the way to your origin; seeing it arrive means something upstream is impersonating the proxy.
The first two are usually a chain, not a single mistake. Every proxy in front of Cloudflare appends its address to X-Forwarded-For, so a request that has passed through several CDNs or corporate proxies can exceed the limit without anyone having configured anything unusual. The HTTP headers reference documents exactly how the value is built up.
4. An SNI mismatch at the origin
When Cloudflare opens the TLS connection to your origin it sends the hostname in the Server Name Indication field. If the origin is configured for a different name, or is fronted by something that rewrites it, the mismatch can surface as error 1000 rather than a certificate error. Check which name the origin’s virtual host and certificate actually expect.
5. A SaaS provider running on Cloudflare
This is the one that is not your fault. Some platforms use Cloudflare for SaaS together with BYOIP, so their own IP ranges are announced through Cloudflare’s network. Your record points at the provider, the address resolves into Cloudflare infrastructure, and if the provider has not created a custom hostname for your domain, the request is refused. The error is generated in their Cloudflare account, so no amount of editing on your side will clear it — the provider has to onboard the hostname.
When that onboarding is done properly, the same setup becomes an ordinary two-zone route rather than an error. That is the subject of Cloudflare orange-to-orange.
Narrowing it down
- Read the record, not the site.In the dashboard, open the DNS records for the zone and look at the stored value of the failing hostname. A lookup against the live site will only show you Cloudflare’s addresses, which tells you nothing.
- Check the value against Cloudflare’s ranges. If the stored address falls inside the published list, you have cause 1 and you are done.
- Follow CNAMEs to the end. A record can be correct and still land on Cloudflare two hops later. Root domains are the usual hiding place, because the value you see is not the value that gets served — see CNAME flattening.
- Grey-cloud the record briefly. Set it to DNS only. If the site then loads at the origin, the record value is fine and the loop is at the origin or in the headers; if it still fails, the address is wrong. Remember the record is exposed while it is grey.
- Request the origin directly. From a shell, send a request to the origin address with the correct
Hostheader. A clean response points at causes 3 or 4; a Cloudflare error page coming back means the origin is bouncing you into the proxy.
Errors that look like 1000 but are not
Cloudflare’s 1xxx family reuses very similar wording, and picking the wrong page costs an afternoon. The distinctions that matter:
| Error | Trigger | First move |
|---|---|---|
| 1000 | The origin address, the origin server, or the request headers send traffic back into Cloudflare | Read the stored record value, then the origin config |
| 1002 | A record value is a Cloudflare address, a CNAME target is wrong, or an off-Cloudflare domain CNAMEs into one | Confirm the target with your host and correct the record |
| 1003 | A client browsed to a Cloudflare IP address directly instead of the domain name | Use the hostname in the URL |
| 1014 | A CNAME crosses into a different Cloudflare account that has not onboarded the hostname | The target’s owner enables Cloudflare for SaaS, or you release a zone hold |
A rough rule: 1002 is a wrong value, 1003 is a wrong URL, 1014 is a missing permission, and error code 1000 is a loop. The full 1xxx index is worth a bookmark if you administer more than one zone.
FAQ
What does Cloudflare error 1000 mean?
It means Cloudflare was asked to forward a request to an address that belongs to Cloudflare. The proxy will not send traffic back into itself, so it stops the request and shows error 1000 instead of looping.
How do I fix DNS points to prohibited IP?
Find the address your proxied record hands to the proxy and replace it with your real origin. In most cases that is an A record holding a Cloudflare anycast address; ask your hosting provider for the server's actual IP address and put that in the record instead.
What is the difference between Cloudflare error 1000 and error 1002?
Both are described as DNS pointing to a prohibited IP, but 1002 is the narrower resolution-time case: a record whose value is a Cloudflare address or a wrong CNAME target. Error 1000 also covers request-time causes such as a reverse proxy at the origin, malformed proxy headers, and SaaS platforms running on Cloudflare's own IP ranges.
Can Cloudflare error 1000 be caused by something other than my DNS records?
Yes. A reverse proxy at your origin that forwards to the public hostname, an X-Forwarded-For header longer than 100 characters, two X-Forwarded-For headers, a client-supplied CF-Connecting-IP header, or an SNI mismatch at the origin will each produce it with the DNS record untouched.
Why do I get error 1000 when my domain points to a SaaS platform?
If that platform runs on Cloudflare and advertises its own IP ranges through Cloudflare's network, your record resolves into Cloudflare infrastructure. Until the platform creates a custom hostname for your domain on their side, Cloudflare treats it as a loop. The fix belongs to the provider, not to you.