Cloudflare Error 523 ("Origin is unreachable") means Cloudflare could not reach your origin server at the network level at all – there was no route to the IP address. In practice the origin IP in Cloudflare DNS is usually wrong, out of date, or a private address, or the server's network is down.
Before you start
- Your server's real IP from cPanel → General Information (open cPanel from Services in the MdmHost dashboard).
- Access to Cloudflare → DNS.
Common causes of Cloudflare Error 523
- An old IP left in Cloudflare after moving hosts or servers.
- A typo in the A record, or a private IP such as
192.168.x.xor10.x.x.x. - A wrong AAAA (IPv6) record: Cloudflare may prefer IPv6 and fail if the server has no working IPv6.
- A network outage or routing problem at the origin's data centre.
How to fix error 523
- Compare every proxied record (orange cloud) in Cloudflare DNS with the server IP from cPanel. Fix any that differ, including
www. - Check AAAA records. If the server has no IPv6 address, delete the AAAA records.
- Test the IP from your own computer with
ping ORIGIN_IPandcurl -I --resolve example.com:443:ORIGIN_IP https://example.com/. - Check our status. If the IP is right but unreachable from several networks, open a ticket with the Ray ID so we can check the network.
Tip: After a migration, update Cloudflare DNS at the same time as you switch hosting. Cloudflare keeps sending traffic to whatever IP you entered, no matter where the domain is hosted now.
What to check afterwards
Reload the site through Cloudflare. DNS changes inside Cloudflare apply almost instantly for proxied records.
FAQ
How is 523 different from 521 and 522?
523: no route to the IP. 521: the server refused the connection. 522: the connection timed out.
Do I need to wait for DNS propagation?
No. With proxied records Cloudflare uses the new origin IP within seconds.
Where do I find my hosting IP?
In cPanel under General Information, or in your welcome email.