Fix Cloudflare Error 1016: Origin DNS Error

If your visitors are seeing a plain Cloudflare-branded page instead of your site — orange header, "Error 1016 Ray ID: ..." and the words "Origin DNS error" — the problem isn't your cPanel hosting itself. It's a DNS record sitting at Cloudflare that points somewhere that no longer resolves. Here's how to find it and fix it in a few minutes.

Symptom

A visitor loads your domain (or a specific subdomain) and gets Cloudflare's own error screen instead of your site:

Error 1016 Ray ID: 8a1f... • 2026-09-04 09:12:44 UTC
Origin DNS error

The confusing part: your site loads fine if you hit the server directly by IP, or if you temporarily pause Cloudflare. That's the tell — this is an edge-side DNS resolution failure, not a server problem, not a hosting outage, and not the same thing as ordinary DNS propagation delay.

Why This Happens

Cloudflare throws 1016 specifically when it can't resolve the hostname your DNS record points to. This almost always means one of your records at Cloudflare is a CNAME pointing at something that's gone — not an A record pointing at a dead IP (that gives a different error, usually 521 or 522).

The usual culprits we see on cPanel accounts moved to SkyServer:

• Leftover CNAME from the old host. A subdomain (often www, shop, or an addon domain) was CNAME'd to something like oldhost.someotherprovider.net, and that hostname was deleted when the old account was cancelled.
• Server hostname changed. If a VPS was rebuilt or renamed in WHM ("Change Hostname"), any DNS record CNAME'd to the old hostname (like server123.oldname.skyserver.in) now points at nothing.
• Typo in the CNAME target. One missing letter or an extra trailing dot in the target hostname is enough.
• CNAME chains that broke mid-chain. Record A is CNAME'd to record B, and record B was CNAME'd to a third-party hostname that expired or was removed — Cloudflare can't walk the chain to an IP.
• Migration left half-finished. Someone pointed the domain to Cloudflare and set a CNAME to "the new server" before the new server's own DNS name existed.

The Fix

1. Find the broken record

In the Cloudflare dashboard, go to DNS > Records. Look at every proxied (orange cloud) record for the affected hostname. You're hunting for a CNAME, not an A record.

Confirm it's actually broken by resolving the target outside Cloudflare:

dig CNAME shop.yourdomain.com +short
dig A oldhost.someotherprovider.net +short

If the second command returns nothing, you've found your record.

2. Get the correct IP

For a cPanel account on SkyServer, the fastest way to get the right IP is WHM:

• WHM > List Accounts — shows the IP assigned to each cPanel account.
• Or in cPanel itself: General Information panel on the right side of the dashboard shows "Shared IP Address" or "Dedicated IP Address."
• On a VPS, just run hostname -I or check WHM > Server Information.

3. Replace the CNAME with an A record

Unless you have a specific reason to CNAME to another hostname (a CDN, a SaaS platform, an email provider's tracking domain), point the record straight at the IP:

Delete the old CNAME, add the new A record with the same proxy status (orange cloud if it was proxied), and save.

4. If you must keep it as a CNAME

Just correct the target so it points at a hostname that actually resolves — usually your account's real cPanel server hostname, which you can confirm with:

whmapi1 gethostname

run from an SSH session on the server (or ask support if you don't have SSH access).

5. Give it a few minutes

Unlike full nameserver propagation, this is an edge cache issue on Cloudflare's side and clears in minutes once the record is corrected. If it's still showing 1016 after 10–15 minutes, do a hard refresh and double-check you edited the record for the exact hostname the browser is hitting (not a different subdomain with the same problem).

How 1016 Differs From Other Cloudflare Errors

It's easy to mix these up when you're staring at an orange error page at 2am. Quick reference:

Prevention

• Whenever you migrate a domain to a new server or rebuild a VPS, audit every DNS record for that domain in Cloudflare — not just the ones you remember changing.
• Prefer A records over CNAMEs for anything pointing at your own hosting. It's one less thing that can break when a hostname changes upstream.
• If you do use CNAMEs (for CDNs, email tools, verification records), keep a note of what each one is supposed to point to, so a broken one is obvious later.
• After a server hostname change in WHM, grep your Cloudflare zone for the old hostname before you forget about it.

Frequently Asked Questions

Is Error 1016 the same as DNS_PROBE_FINISHED_NXDOMAIN?

No. NXDOMAIN happens in the browser when your domain's nameservers can't be resolved at all — it means DNS is broken at the root. Error 1016 only appears when your domain is already successfully proxied through Cloudflare, and the problem is one specific record's target failing to resolve behind the scenes.

Why does my site load fine when I bypass Cloudflare?

Because the server itself is healthy. Cloudflare sits in front of your DNS and needs to resolve the CNAME target to know where to send traffic. If you hit the server's IP directly, or use a hosts file entry, you skip that resolution step entirely and it works.

Will purging the Cloudflare cache fix it?

No. Purging cache only affects cached content, not DNS resolution. You have to fix the actual DNS record.

How long after fixing the record does the error go away?

Usually within a few minutes. This isn't full DNS propagation across the internet's resolvers — it's Cloudflare's own edge re-resolving one record. If it's still broken after 15 minutes, you likely edited the wrong record or there's a second broken hostname in the chain.

Does this affect my email too?

Only if you proxy MX or mail-related records through Cloudflare, which you generally shouldn't. Cloudflare doesn't proxy MX records at all, and mail-related CNAMEs (like autodiscover) should stay on "DNS only" (grey cloud), so a 1016 error on your website's A/CNAME record won't touch mail delivery.