What is actually happening
Cloudflare sits between your visitor and your real server. The visitor reaches Cloudflare, and Cloudflare then has to reach your origin.
Error 1000 is Cloudflare saying it looked up where to go next and found itself, or found something that would send it straight back. So it stops. The error page comes from Cloudflare, but the wrong address is in your configuration.
Error 1000: DNS points to prohibited IPThe "prohibited IP" is normally a Cloudflare IP address. Cloudflare will not proxy to its own network, because that is a loop.
Every documented cause
Cloudflare lists these. Read them properly, because several look nothing like a DNS problem and people miss them:
- →An A record in your Cloudflare DNS points at a Cloudflare IP address. Or a Load Balancer origin points at a proxied record. This is the classic case.
- →Your A or CNAME record references another reverse proxy, and that proxy then proxies the request back to Cloudflare a second time.
- →The request X-Forwarded-For header is longer than 100 characters.
- →The request includes two X-Forwarded-For headers rather than one.
- →The request includes a CF-Connecting-IP header. That header is Cloudflare's own, so seeing it arrive means something upstream has already been through Cloudflare.
- →An SNI issue or mismatch at the origin. Server Name Indication tells the server which site is being requested, and if it does not line up the request can fail here.
- →A record pointing at a SaaS provider using Cloudflare for SaaS with BYOIP, where no custom hostname has been configured for your domain.
How to fix it
Match the fix to the cause you found above.
- 1.Point the A record at your real origin IP address. The address of the server that actually hosts your site, not a Cloudflare address and not a proxied record. This resolves the majority of 1000 errors on its own.
- 2.Replace a second reverse proxy with an HTTP redirect at the origin. If you were proxying in order to send traffic somewhere else, do it with a redirect instead. One proxy in the chain, not two.
- 3.Contact your SaaS provider about custom hostname configuration if your record points at a platform running Cloudflare for SaaS. That side has to be set up before your domain will resolve through it correctly.
The one that takes stores offline
We have already documented this exact error in a different context, and it is worth flagging because the failure is total rather than partial.
BigCommerce requires the store domain to be pointed by CNAME, not by an A record. Point it with an A record instead and the store goes down with a 1000 error. Not slower, not degraded. Offline.
The correct setup is covered in our guide to security headers on BigCommerce. The same principle applies to any hosted platform: use the record type the platform documents, not the one you are used to.
Webflow has a related trap on the certificate side, which produces Error 525 instead. See security headers on Webflow.
Errors that are not this one
If your symptoms do not match, check these before you start editing DNS:
DNS is fine. The secure handshake to your origin fails. See Cloudflare Error 525.
The handshake completes, then the origin certificate fails validation. See Cloudflare Error 526.
Also a loop, but a redirect loop between proxy and origin. See ERR_TOO_MANY_REDIRECTS.
The secure connection fails between the visitor and the server. See ERR_SSL_PROTOCOL_ERROR.
Frequently asked questions
Why does Cloudflare refuse to proxy to its own IP addresses?
Because it would be a loop. Cloudflare receives the request, looks up where to send it, and finds an address that leads back to Cloudflare. Rather than going round forever it stops and returns Error 1000.
How do I know which IP address to put in the A record?
It is the address of the server that actually hosts your site, which your hosting provider can tell you. If your host gives you a hostname rather than an address, or documents a CNAME, use what they document. Do not copy an address out of Cloudflare.
Why would a header cause a DNS error?
The error name is about the most common cause, not the only one. Cloudflare also returns 1000 when the incoming request carries signs of having already passed through Cloudflare, such as a CF-Connecting-IP header, two X-Forwarded-For headers, or an X-Forwarded-For header longer than 100 characters. These usually mean another proxy in front of you is adding them.
Can I keep another CDN or proxy in front of Cloudflare?
Not if it proxies back into Cloudflare, which is what triggers this. Cloudflare's documented answer is to use an HTTP redirect at the origin instead of a second reverse proxy. One proxy layer in the chain, not two.
Is my site insecure while this is happening?
No. Nothing is being exposed. Visitors get a Cloudflare error page and never reach your server. It is an availability problem. Once it is resolved, run a free site check to confirm the rest of your setup, including your SSL certificate and HTTPS configuration.