Origin DNS Error or Tunnel Error

Cloudflare-specific. Cloudflare couldn't find where to send the request: it couldn't resolve the origin's hostname, or the Cloudflare Tunnel for it isn't connected.

A 530 always comes with a 1xxx error in the response body, and that code tells you which problem it is. Cloudflare returns 530 for two of them: 1016, an origin DNS error, and 1033, a Cloudflare Tunnel error.

What we see on Larm

Failed HTTP checks on Larm from 9 October to 8 November 2026, across about 130 monitors.

5 monitors got a 530 in this period, with 652 failed checks in total, more than any other Cloudflare code. The median time to first byte was 44 ms: Cloudflare answers right away, since it has nowhere to send the request.

COMMON CAUSES

1016: the origin's A record is missing, or a CNAME points to a domain that doesn't resolve

1016: a load balancer pool uses an origin hostname that doesn't resolve

1033: the cloudflared process stopped, or was never started on the origin

1033: the DNS record points to the wrong tunnel

1033: a firewall blocks cloudflared from reaching Cloudflare

HOW TO FIX IT

Read the 1xxx code in the response body to see which case you're in

For 1016, check that the A record points to a valid IP and that any CNAME target resolves

For 1033, check the tunnel's status in the Cloudflare dashboard or with cloudflared tunnel list, and restart cloudflared if it's down

For 1033 with a healthy tunnel, check that the DNS record points to the right tunnel

What this means for monitoring

If you run your origin behind Cloudflare Tunnel, a 530 usually means cloudflared stopped. The server can be perfectly healthy and still unreachable, so monitor the public URL, not just the machine.

Related status codes

5xx Server Error

500

Internal Server Error

Something went wrong on the server and it has nothing more specific to say. It's what most frameworks return when your code throws an exception it doesn't handle.

502

Bad Gateway

A server in the middle, like a load balancer, reverse proxy or CDN, tried to pass your request on to the server behind it and got back something it couldn't use. Either the upstream server didn't answer properly, or the connection closed before a full response came back.

503

Service Unavailable

The server is up but can't handle the request right now. It's meant to be temporary: overload, maintenance, or an app that isn't ready yet.

504

Gateway Timeout

A proxy or load balancer forwarded your request and gave up waiting for the server behind it to answer.

520

Web Server Error

Cloudflare-specific. Cloudflare connected to your origin server and got a response it couldn't use, or no response at all.

521

Web Server Down

Cloudflare-specific. Cloudflare tried to connect to your origin server and the connection was refused.

522

Connection Timed Out

Cloudflare-specific. Cloudflare tried to connect to your origin and the connection timed out.

523

Origin Unreachable

Cloudflare-specific. Cloudflare can't find a network route to your origin server.

525

SSL Handshake Failed

Cloudflare-specific. Cloudflare connected to your origin but couldn't complete the TLS handshake with it.

Get alerted when your endpoints return unexpected status codes.

Larm checks your HTTP endpoints from multiple global locations and alerts you when they return status codes outside your expected range.