Cloudflare 522 vs 523 origin unreachable

522 versus 523

Both codes sit in the "cannot reach the origin" family, but they fail at different layers:

| Error | When it appears | What it implies |

| 522 | Origin connection timed out | Network reachable path, but nothing answered in time |

| 523 | Origin is unreachable | No route / DNS / IP range can even start the connection |

523 means Cloudflare could not establish any connection to the origin address at all. 522 means the edge connected (or tried to) and waited for a response that never arrived. Knowing which code you have already narrows the cause list.

Cause comparisons

| Cause | 522 | 523 |

| Server offline at the IP | Sometimes | Yes |

| Firewall dropping the edge | Yes | Yes |

| Wrong IP in the DNS record | Sometimes (drops) | Yes |

| IPv6 missing / bad routing | Yes | Yes |

| Host network or provider outage | Yes | Yes |

| Origin responds slowly | Yes | No |

Route checks for 523

1. Confirm the address in the record. A typo in the A/AAAA, or an address that belongs to an old provider, points Cloudflare at a dead host and yields 523.
2. Test IP reachability from your own network:

ping 203.0.113.25
curl -vk --resolve www.example.com:443:203.0.113.25 https://www.example.com/

If the ping works and curl reaches your host, the issue is between Cloudflare and the IP (geo routing, a firewall range rule, or the host blocking the edge).

1. Check for IPv6 mismatch. If the zone has an AAAA record that points nowhere, some paths take the v6 route first. Test with curl -6 and ping -6.
2. Confirm the zone's origin host is the same host the site actually runs on. DNS only tests: flip the record grey and verify the site loads from the direct IP.

Fix per diagnosis

| Result you see | Next step |

| Grey record works, orange gives 523 | Firewall/edge range, or the SSL mode (see firewall guide) |

| Grey record fails too | Hosting outage, host reachability, or bad IP in the record |

| Only some regions fail | Route-level issue, GeoIP policy, or the host's regional blocks |

| Everything failed at the same time | Contact host, look for cloud maintenance (load balancer, IP change) |

Associated codes in the same family

Two more codes live next to 522 and 523 and often get confused with them:

| Error | Meaning | Connection to 522/523 |

| 1016 | Origin DNS error | Cloudflare cannot resolve the origin hostname in the record |

| 523 | Origin unreachable | No route to the origin address |

Error 1016 appears when the record points at a hostname (instead of an IP) that Cloudflare cannot resolve, for example a CNAME target that returns no answer. It can masquerade as 523: fix the DNS record that the origin resolves to, then the route returns to the normal 522 family.

Precision in wording

When you report an error, avoid "origin unreachable" as a catch-all. State the exact code first, then the layer you confirmed:

• 522: "The edge could connect (or try) but the origin never finished the handshake/data in time."
• 523: "The correct-looking route has no viable path: IP, host, firewall, or route."
• 1016: "The origin hostname Cloudflare was asked to resolve did not answer."

That level of precision also changes the tools: 522 pushes toward timeout debugging (server logs, slow query), 523 pushes toward address / routing / firewall (traceroute, DNS, security groups), and 1016 pushes toward the DNS record itself.

Prevention

• Keep the "both grey and orange" diagnostic habit: grey tests the origin, orange tests the edge, and the difference between the two is the Cloudflare layer.
• Document the origin IPs in the zone description so a 523 triage does not start from a memory mistake.
• For migrations, keep a second A record (a direct.example.com grey record) so Cloudflare reachability can always be isolated from visitor delivery.