Cloudflare Edge Errors
DNS Points to Prohibited IP
Reviewed for reference consistency: August 11, 2026
DNS Points to Prohibited IP
What 1000 Means
The 1000 error on the Cloudflare Edge Errors indicates dns points to prohibited ip. This typically occurs due to an a record in the cloudflare dns app points to one of cloudflare's own proxy ip addresses.
Error 1000, 'DNS points to prohibited IP', means a record in the zone targets an address Cloudflare will not route to. Most often the address is one of Cloudflare's own proxy IPs, which would loop the request back to the edge instead of an origin server. Cloudflare's troubleshooting page also ties this error to origin reverse proxies that re-proxy to Cloudflare and to requests carrying headers such as an oversized or duplicated X-Forwarded-For or a CF-Connecting-IP value. The record itself is fixed in the Cloudflare DNS dashboard, not on the visitor side.
How to fix 1000
General informational guidance, not professional advice. Commands can affect your system or data — back up first and proceed at your own risk. FixerCode is an independent reference, not affiliated with any vendor mentioned.
Check what the hostname publicly resolves to
A proxied Cloudflare zone answers DNS queries with Cloudflare's anycast IP addresses, so seeing those IPs confirms the proxy is in the path. The A-record value that triggers 1000 is only visible in the Cloudflare DNS dashboard, where the fix is made.
nslookup example.com 1.1.1.1Search the origin's proxy config for a loop back through Cloudflare
Cloudflare lists an origin reverse proxy that re-proxies traffic back through Cloudflare among the causes of 1000. A matching proxy_pass rule aimed at your public hostname is the loop to remove.
grep -rn "proxy_pass" /etc/nginx/
Technical Background
Cloudflare's official description: the error indicates that a Cloudflare DNS record points to a prohibited IP, blocking access to the requested domain. The documented cause list goes beyond DNS records — it also covers Load Balancer origins pointing at proxied records, origin reverse proxies that re-proxy traffic back through Cloudflare, and request-side conditions such as a CF-Connecting-IP header or an oversized X-Forwarded-For header.
The block happens at the edge, before any connection to an origin is attempted: the visitor cannot fix anything on their side, and the request stops at the edge without reaching an origin.
The correction belongs to the site owner. The DNS fix is made in the Cloudflare dashboard — point the record at the hosting provider's origin IP — while a proxy loop at the origin has to be removed from the origin's own configuration.
Common Causes
- An A record in the Cloudflare DNS app points to one of Cloudflare's own proxy IP addresses
- A Load Balancer origin points to a proxied record instead of the real origin IP
- The DNS record targets a reverse proxy (for example an nginx proxy_pass rule) that re-proxies the request back through Cloudflare
- The request carries a CF-Connecting-IP header, or an X-Forwarded-For header longer than 100 characters or duplicated
- The domain uses a Cloudflare-for-SaaS provider (BYOIP) that has not configured a custom hostname for it
Typical Scenarios
- The site owner pings their own domain and pastes the reply into the A record: a proxied domain answers with a Cloudflare edge IP, which the zone then points back at
- An origin server runs a reverse proxy whose rules forward traffic back out through Cloudflare (for example an nginx proxy_pass aimed at the public hostname), creating the loop the edge blocks
- A request arrives already carrying a CF-Connecting-IP header, or an X-Forwarded-For header longer than 100 characters, which Cloudflare lists among the direct causes of 1000
- A domain sits behind a Cloudflare-for-SaaS provider that has not configured a custom hostname for it, so the request lands in the provider's account without one
What to Know
The correction belongs to the site owner: point the flagged record at the hosting provider's real origin IP in the Cloudflare DNS dashboard. If the record is already correct, check the origin for a reverse proxy that routes traffic back through Cloudflare, or contact the SaaS provider when the domain runs through one.
Frequently Asked Questions
Common questions about Cloudflare 1000 error
The fix is a site-owner action, not a visitor action. Open the Cloudflare dashboard, check the DNS app, and point the flagged A record at your hosting provider's real origin IP instead of a Cloudflare IP or another proxy. If the record already looks correct, look for an origin reverse proxy that sends traffic back through Cloudflare, or — for Cloudflare-for-SaaS setups — ask the provider whether a custom hostname is configured for your domain.
Both errors are documented around prohibited IP addresses, and Cloudflare's pages list overlapping causes for them. 1002 has a 'Restricted' variant for a domain that resolves to a local, disallowed, or mismatched IP address. 1000's page additionally documents causes that never touch DNS: a request carrying a CF-Connecting-IP header or an oversized X-Forwarded-For header. The practical first step is the same: point the record at the real origin IP.
On a proxied zone, DNS queries answer with Cloudflare's anycast IP addresses, not with the origin server's address. Those edge IPs are exactly the addresses Cloudflare prohibits as origins for the same zone, so copying them into an A record produces 1000. The origin IP has to come from your hosting provider.
No. The error is about where the record points, not about the origin's health: Cloudflare stops the request before it attempts a connection to the origin. An offline origin sitting behind a correct record produces different Cloudflare errors.
Related Error Codes
Related Errors From Other Categories
Similar error codes documented across different platforms and systems