Cloudflare Error 1000: DNS points to a prohibited IP

TL;DR

Find the real origin IP from your hosting provider (not from DNS), set the record, and confirm with dig that the record no longer resolves to a Cloudflare range.

Steps

1. - Copying the resolved IP of a proxied record (which is a Cloudflare edge IP) into a new A record as the "origin". The proxy hides your origin IP from public DNS, so the only visible IP is Cloudflare's: copying it creates a loop.

• Migration scripts that read back DNS and write it forward without distinguishing proxied from DNS-only records.

2. The A/AAAA record must point at your actual origin server IP. Find the real origin IP from your hosting provider (not from DNS), set the record, and confirm with dig that the record no longer resolves to a Cloudflare range.
3. - Never copy a proxied record's resolved IP into another record.

• After any DNS migration, scan A/AAAA records for Cloudflare IPs.
• Keep the true origin IP documented outside DNS, because DNS will not show it to you once proxied.

When to use

You are seeing this: Error 1000 is a DNS resolution failure: an A record in your zone points to a Cloudflare IP address. Use this skill when you run into "Cloudflare Error 1000: DNS points to a prohibited IP".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Verified against the live error diagnostic headers doc: cf-error-type 1000 = DNS resolution failure, A record points to a Cloudflare IP. Ref: https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-error-headers/