Turkey (Turkish)
Germany (German)
Worldwide (English)
Cloudflare 1016 means Cloudflare cannot resolve the origin web server's IP address through DNS.
Halkali merkez neighborhood fatih st ozgur apt no 46 , Kucukcekmece , Istanbul , 34303 , TR
Cloudflare 1016 Origin DNS Error: diagnose missing A/AAAA records, unresolved CNAMEs, Load Balancer origins, Workers Partial Zone and SaaS causes.
Cloudflare 1016 means Cloudflare cannot resolve the origin web server's IP address through DNS.
Cloudflare's current documentation separately lists missing A records, unresolvable external CNAMEs, Load Balancer origin hostnames and Workers Partial Zone cases.
In Cloudflare for SaaS, ownership validation, fallback-origin and wildcard custom-hostname conflicts can also produce 1016.
1016 happens at DNS resolution: Cloudflare has not reached the point of connecting to the origin IP. 521 involves a refused/down origin and 522 a timeout. With 1016, first answer which IP Cloudflare is supposed to resolve for the origin.
This distinction prevents wasted work. Restarting Nginx, changing firewall rules or replacing certificates will not solve 1016 if the origin hostname itself cannot resolve.
One of Cloudflare's documented causes is a missing A record for the origin. Do not rely only on what the dashboard shows; query public DNS and verify that the hostname actually returns an A/AAAA answer.
A wrong AAAA record can create separate connectivity problems. For 1016, first establish whether resolution exists at all, then verify that the returned IP points to the intended origin.
nslookup origin.example.comdig +short A origin.example.comdig +short AAAA origin.example.comCloudflare must be able to follow the CNAME chain to a resolvable IP. If an external target was removed, mistyped or exists only in private DNS, Cloudflare cannot derive an origin address.
Inspect the CNAME chain through multiple public resolvers. DNSSEC or delegation issues can make one resolver appear healthy while Cloudflare's resolvers cannot obtain a valid answer.
dig CNAME app.example.com +shortdig app.example.com @1.1.1.1dig app.example.com @8.8.8.8If a Load Balancer pool uses a hostname rather than an IP, that hostname must also resolve. A resolution failure can break routing even before you focus on HTTP health checks.
If the origin hostname is in the same Cloudflare zone, avoid recursive or circular proxy dependencies. A dedicated, directly resolvable origin hostname makes troubleshooting safer.
Cloudflare explicitly documents that Workers subrequests in Partial CNAME setups can return 1016 when the target hostname has no actual DNS record in the zone. Constructing a URL in Worker code does not create DNS.
In that case, inspect the Worker fetch target, zone DNS records and the Partial CNAME architecture together. Debugging only the script is insufficient.
With SaaS custom hostnames, also inspect ownership validation, fallback origin and custom-hostname status. Cloudflare for SaaS documents 1016 when validation is incomplete or the fallback origin is invalid.
A wildcard custom hostname can also conflict with a standalone Cloudflare zone. In this architecture, troubleshooting only the DNS record misses the SaaS control-plane state.
After fixing DNS, verify A/CNAME answers through multiple resolvers, then test the proxied hostname. If the error changes from 1016 to 521, 522 or 525, DNS is likely fixed and the next origin layer is now exposed.
curl -I https://app.example.com| Scenario | Check |
|---|---|
| Missing A/AAAA | Public DNS answer for origin hostname |
| External CNAME does not resolve | CNAME chain and authoritative DNS |
| Workers Partial Zone | Actual DNS record for target in the zone |
| Cloudflare for SaaS | Ownership, fallback origin, custom-hostname status |
Before production changes, verify context and keep backups and a rollback plan. Do not change several DNS, TLS, recovery, Docker or WordPress variables at once because it obscures the root cause.
No. 1016 primarily means the origin hostname cannot be resolved to an IP; a healthy server can still produce 1016 if DNS is wrong.
No. Fix DNS resolution first. SSL handshake matters only after Cloudflare can reach an origin IP.
The 1016 layer may be resolved; Cloudflare can now reach the origin but TLS handshake fails. Diagnose 525 separately.
If the problem persists in hosting, VPS, Docker, Cloudflare, Windows or WordPress infrastructure, open a technical support request with the exact error output and current architecture.