# Error 1000: DNS points to prohibited IP

Error 1000 is a DNS resolution failure: an A record in your zone points to a Cloudflare IP address. Cloudflare refuses to proxy to itself, so the request dies at the DNS layer (cf-error-type `1000`).

## How it happens

- Copying the resolved IP of a proxied record (which is a Cloudflare edge IP) into a new A record as the "origin". The proxy hides your origin IP from public DNS, so the only visible IP is Cloudflare's: copying it creates a loop.
- Migration scripts that read back DNS and write it forward without distinguishing proxied from DNS-only records.

## The fix

The A/AAAA record must point at your actual origin server IP. Find the real origin IP from your hosting provider (not from DNS), set the record, and confirm with `dig` that the record no longer resolves to a Cloudflare range.

## Checklist

- Never copy a proxied record's resolved IP into another record.
- After any DNS migration, scan A/AAAA records for Cloudflare IPs.
- Keep the true origin IP documented outside DNS, because DNS will not show it to you once proxied.