Netlify site down after moving DNS to Cloudflare: 500, blank page and 403 on the custom domain

Netlify site down after moving DNS to Cloudflare: 500, blank page and 403 on the custom domain

TL;DR

If the site still loads on its netlify.app subdomain, the deploy is fine and the DNS move broke it. In Cloudflare DNS, point www at the site subdomain with a CNAME and the proxy switched off (DNS only), point the apex (root) domain at Netlify with an A record to 75.2.60.5 or an ALIAS/ANAME, and delete every other A or AAAA record for the same names. Only after DNS resolves cleanly will Netlify provision the HTTPS certificate and the 500, blank page, timeout and 403 errors clear.

Error message

500 Internal Server Error (or a blank page) on the custom domain
403 Forbidden on the custom domain
connection timed out on the custom domain
the same site loads fine at [sitename].netlify.app

Steps

1. Confirm the split first. Open the netlify.app subdomain. Expected: the site loads normally there. Success check: if it fails there too, this skill does not apply, the problem is the deploy, not DNS.
2. Fix the www record in Cloudflare DNS. Set www as a CNAME to the site subdomain, [sitename].netlify.app, and set the proxy status to DNS only (grey cloud). Expected: one www record, unproxied. Success check: a lookup for www returns the Netlify target, not a set of Cloudflare anycast addresses.
3. Fix the apex (root) record. A root domain cannot use a plain CNAME. Either add a single A record for the apex pointing to 75.2.60.5, or use an ALIAS/ANAME record pointing to apex-loadbalancer.netlify.com. Expected: exactly one apex route to Netlify. Success check: a lookup for the bare domain no longer returns the old host or a parked page.
4. Delete conflicting records. Remove every other A and AAAA record for the apex and www names, especially leftover records for the previous host and any duplicate A or AAAA entries the Cloudflare scan imported. Expected: one record per name. Success check: repeated lookups return the same single answer instead of rotating IPs.
5. Leave the proxy off for Netlify records. Cloudflare orange-cloud proxying in front of Netlify commonly produces exactly this mix: 403 on one hostname, timeouts or a 500/blank page on another, and failed certificate checks. Expected: grey cloud on the apex and www records.
6. Wait for propagation, then fix HTTPS last. In Netlify, open Domain management, then HTTPS, verify the DNS check passes, and only then provision or renew the certificate. Expected: the certificate provisions once DNS points at Netlify. Success check: loading the custom domain over HTTPS returns the site with a valid certificate and no 403, 500 or timeout.

When this applies

• The site broke right after DNS moved to Cloudflare (or another external DNS host) and the registrar is elsewhere, for example Hostinger.
• The netlify.app subdomain still works.
• Different hostnames fail differently: apex vs www, 500 on one site, 403 or timeouts on another.

When this does not apply

• The netlify.app subdomain is also down: that is a deploy or Netlify outage problem, not DNS.
• DNS is hosted at Netlify DNS itself: the records are managed for you, so look at the domain assignment instead.
• The domain shows a Netlify 'site not found' page with correct DNS: the domain is probably not added to the site in Domain management.

Variant phrasings

Site works on netlify.app but not on my domain

Same split, same fix: the origin is healthy, so rebuild the apex and www records as in steps 2-4.

403 Forbidden after connecting Cloudflare to Netlify

Almost always the proxy: switch the records to DNS only and remove conflicting A/AAAA entries, then re-check HTTPS.

Apex domain broken but www works (or the reverse)

One of the two records is wrong. www wants the CNAME to the site subdomain; the apex wants the A record to 75.2.60.5 or an ALIAS/ANAME, never a plain CNAME.

Why it happens

Cloudflare's setup scan imports whatever records it finds, including stale A and AAAA records, and defaults records to proxied. Netlify sites are not served from one fixed origin IP per hostname in the way a proxied setup assumes, so visitors land on conflicting endpoints: one request hits Netlify without a matching site or certificate (403, 500, blank page), the next hits a dead imported address (timeout). The netlify.app subdomain bypasses all of it, which is why it keeps working.

Edge cases

• Certificate will not provision: DNS is still returning a proxied or conflicting answer somewhere. Re-check the apex and www lookups before retrying; repeated retries do not fix bad records.
• Only the apex is used, no www: the A-record route alone is enough, but add www with a redirect to the apex in Netlify so both spellings work.
• Migrating from another host the same week: delete that host's records in the same pass. Leaving them in place keeps a share of visitors on the old server and looks like random intermittent downtime.

Provenance

Resolved from the public thread: https://answers.netlify.com/t/all-of-my-websites-are-down/194291

In the Netlify support thread 'All of my websites are down' (answers.netlify.com topic 194291, OP Impakt, Oct 17 2026, 0 replies at scout time): two sites broke immediately after the OP started changing DNS to Cloudflare, while both still worked on their netlify.app subdomains. One returns a 500 error or a blank page, the other first timed out and then returned 403 Forbidden. Domains are registered at Hostinger and use Cloudflare for DNS only. The pattern (healthy origin subdomain, broken custom domain right after a DNS move) points at the DNS records, not the deploys.