The short version
- 01As a visitor, report the code, affected URL and failure time to the site owner.
- 02As the owner, compare Cloudflare's A and AAAA record values with the hosting provider's origin IP.
- 03Ask the hosting provider to investigate routing between Cloudflare and the origin.
- 04In AWS, check whether an overly broad 172.0.0.0/8 route captures Cloudflare traffic.
- 05Request an origin-side MTR or traceroute to a Cloudflare IP previously seen in the origin logs.
- 06Retest the affected public URL after correcting the address or network route.
Raw message
Error 523 — Origin is unreachable
Likely causes
- A Cloudflare DNS record points to the wrong origin address.
- A network device has no route to the origin IP.
- An overly broad AWS VPC route captures traffic for Cloudflare's public addresses.
An unreachable origin calls for address and route checks
Cloudflare defines 523 as an origin it cannot contact and specifically identifies a missing network route as a common cause. Its first checks are the configured A and AAAA origin addresses and Internet routing.
That gives this page a different starting point from 522's connection timeout. Our recommendation is to note recent hosting or network changes and establish whether every hostname fails or one hostname does. The code alone does not identify which network device needs repair.
Compare the origin configuration with the host's records
Verify the origin IP values inside Cloudflare's DNS dashboard against the hosting provider's current addresses. In AWS, Cloudflare warns that a broad 172.0.0.0/8 VPC route can capture its public 172.64.0.0/13 traffic and send it toward a private destination.
Have the network owner review the applicable route table and intended destination. Our recommendation is to record the original configuration and change only the demonstrated fault. Do not infer a replacement origin address from the public proxied DNS answer or copy a route from an unrelated deployment.
Give the host evidence from the origin's side
Cloudflare asks for an MTR or traceroute from the origin to a Cloudflare IP that commonly connected before the failure, identified in origin logs. A trace from a visitor's laptop tests a different path.
Visitors should report the specific code, URL and time with timezone to the site owner. Our editorial verification step for owners is to retest the affected hostname through its public route after repair. Record whether 523 stops or changes to another code, then use that code's specific investigation.
Sources and review notes
Checked on . Based on Cloudflare's 523 and 5xx documentation, checked October 1, 2026. Scope comparisons and preserving the original configuration are editorial guidance. AWS route changes require knowledge of the deployment. Glitchary is independent of Cloudflare.