522 Connection Timed Out

Cloudflare documents two timeouts behind 522. Before the connection exists, it sends a SYN and waits 19 seconds for a SYN+ACK, retrying at 1, 1, 1, 1, 1, 2, 4 and 8 seconds. After the connection is established, it waits up to 90 seconds for the origin to acknowledge the request.

Silence is the signature. A server that is down but reachable answers with a reset (521); a firewall that drops packets, an origin IP that no longer belongs to you, or a machine too overloaded to accept connections just lets the SYN go unanswered.

Other documented causes: keepalives disabled on the origin, an A record in the Cloudflare DNS that still points at an old IP after a server move, and a Worker on a Custom Domain calling fetch() on its own hostname.

If you are visiting the site

• The site’s origin server is overloaded or unreachable from Cloudflare. The error page will show Cloudflare working and the host in error.

If you run the server

• Firewall rules (iptables DROP, cloud security groups, hosting DDoS filters) that do not include every Cloudflare range.
• The origin IP in the Cloudflare DNS app is out of date after a migration or a dynamic IP change.
• The server is saturated: full accept queue, exhausted worker processes, or a SYN flood.
• Keepalives disabled at the origin, which Cloudflare lists as a cause.

If you are visiting the site

• Retry in a few minutes. If only this one site fails, the problem is theirs, not your connection.

If you run the server

• Compare the A and AAAA records in the Cloudflare DNS app with the IP your host currently assigns.
• Test a raw TCP connection to the origin from outside (nc -vz ORIGIN_IP 443) and look for drops in the firewall counters.
• Allowlist all IPv4 and IPv6 ranges from cloudflare.com/ips in the host firewall, cloud security group and any hosting-level protection.
• If the server is overloaded, raise worker limits or capacity, and check load and connection counts during the errors.
• Send your host the details Cloudflare asks for: the time with timezone, URL, Ray ID and an MTR from the origin to a Cloudflare IP.

Cloudflare generates this code at its edge when it cannot get a usable answer from your origin; your server never sends it. The commands below talk to the origin directly, skipping Cloudflare, so you can see what Cloudflare sees.

# Does the origin complete a TCP handshake within 19 seconds?
nc -vz -w 19 ORIGIN_IP 443

# Full request to the origin, bypassing Cloudflare
curl -sv -o /dev/null --connect-timeout 19 --resolve example.com:443:ORIGIN_IP https://example.com/

# Path from the origin toward a Cloudflare IP (share with your host)
mtr -rwc 50 CLOUDFLARE_IP

522 vs 504

A 504 comes from a gateway that connected upstream but got no response in time; a 522 means Cloudflare could not even complete the connection to your origin.

522 vs 524

522 fails at the connection stage; with 524 the connection and request went through and the origin was too slow to respond.

522 vs 521

521 is a fast, explicit refusal; 522 is a slow failure with no answer at all.

How long does Cloudflare wait before showing 522?

Cloudflare documents 19 seconds without a SYN+ACK before the connection exists, or 90 seconds without an acknowledgment of the request after it is established.

Why is error 522 intermittent?

Intermittent 522s usually mean load or rate limiting: the origin accepts connections until its queue fills or a firewall starts throttling the busiest Cloudflare IPs. Correlate the errors with traffic peaks.

Can a wrong DNS record cause 522?

Yes. If the A record in Cloudflare points to an IP you no longer own, packets go to a machine that ignores them and Cloudflare times out. Cloudflare lists this among the common causes.

Do I get 522 from a Cloudflare Worker?

A Worker on a Custom Domain that fetches its own hostname gets 522. Use a Route, fetch a different hostname, or enable the global_fetch_strictly_public compatibility flag.