HTTP status code · Unofficial, used by Cloudflare
523 Origin Is Unreachable
Error 523 means Cloudflare could not reach your origin at all, because a network device on the way has no route to the origin IP. The usual causes are a wrong A or AAAA record in the Cloudflare DNS app and a routing problem at the hosting provider.
| Class | 4xx/5xx, Unofficial codes (nginx, Cloudflare) |
|---|---|
| Defined in | Cloudflare docs: Error 523 |
| Cacheable by default | Only with explicit Cache-Control or Expires; Cloudflare's default edge TTLs only cover 200, 206, 301, 302, 303, 404 and 410, so a 52x is not cached by default |
| Safe to retry | Only after the routing problem or the origin IP in DNS is fixed |
| Relevant headers |
|
What 523 means
Where 522 is a connection that goes unanswered, 523 is a destination the network cannot find. Cloudflare calls out a specific trap in AWS: a broad route such as 172.0.0.0/8 in a VPC route table swallows 172.64.0.0/13, a range Cloudflare uses for its own public IPs, so replies to Cloudflare are sent to a private destination instead of the internet gateway.
Common causes
If you are visiting the site
- The site’s hosting network is unreachable right now. Nothing on your side causes it.
If you run the server
- The A or AAAA record in Cloudflare points to an IP that no longer exists or was never routed publicly (a private 10.x or 192.168.x address).
- An outage or misconfiguration in the hosting provider’s network.
- In AWS, a VPC route broader than 172.64.0.0/13 sending Cloudflare-bound traffic somewhere private.
How to fix it
If you are visiting the site
- Wait and try later; routing outages at a host are usually fixed within hours.
If you run the server
- Verify the origin IP in the Cloudflare DNS app against the public IP your server actually has.
- Run traceroute or mtr from the origin to a Cloudflare IP and send the output to your host.
- In AWS, add a more specific route for 172.64.0.0/13 to the internet gateway, or narrow the broad private route.
How to diagnose 523
Cloudflare generates this code at its edge when it cannot get a usable answer from your origin; your server never sends it. The commands below talk to the origin directly, skipping Cloudflare, so you can see what Cloudflare sees.
# On the origin: what public IP does it really have?
curl -s https://ifconfig.me
# Is the origin reachable, and where does the path break?
mtr -rwc 50 ORIGIN_IP
# AWS: look for routes that swallow Cloudflare's 172.64.0.0/13
aws ec2 describe-route-tables --query 'RouteTables[].Routes[].DestinationCidrBlock'Commonly confused with
- 523 vs 522
- With 522 the origin is reachable but does not answer the connection in time; with 523 there is no route to it at all.
- 523 vs 502
- A 502 means a gateway reached an upstream and got a bad response back; 523 means the upstream could not be reached.
Frequently asked questions
- Is error 523 a DNS problem?
- Often. The hostname resolves to Cloudflare, but the origin address configured in the Cloudflare DNS app is wrong or unroutable. Checking that record is the first step.
- How is 523 different from 521?
- With 521 Cloudflare reached the origin and was refused. With 523 its packets never found a way to the origin IP.
- Why does 523 happen on AWS?
- Cloudflare documents VPC route tables with broad routes like 172.0.0.0/8 that overlap its public range 172.64.0.0/13, so return traffic goes to a private target. A specific route for 172.64.0.0/13 to the internet gateway fixes it.
Last reviewed by Arielton Oberek.