Cloudflare Error 1000: DNS points to a prohibited IP

Error 1000: DNS points to prohibited IP

Error 1000 is a DNS resolution failure: an A record in your zone points to a Cloudflare IP address. Cloudflare refuses to proxy to itself, so the request dies at the DNS layer (cf-error-type 1000).

How it happens

• Copying the resolved IP of a proxied record (which is a Cloudflare edge IP) into a new A record as the "origin". The proxy hides your origin IP from public DNS, so the only visible IP is Cloudflare's: copying it creates a loop.
• Migration scripts that read back DNS and write it forward without distinguishing proxied from DNS-only records.

The fix

The A/AAAA record must point at your actual origin server IP. Find the real origin IP from your hosting provider (not from DNS), set the record, and confirm with dig that the record no longer resolves to a Cloudflare range.

Checklist

• Never copy a proxied record's resolved IP into another record.
• After any DNS migration, scan A/AAAA records for Cloudflare IPs.
• Keep the true origin IP documented outside DNS, because DNS will not show it to you once proxied.

Verified against the live error diagnostic headers doc: cf-error-type 1000 = DNS resolution failure, A record points to a Cloudflare IP. Ref: https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-error-headers/