Domain moved

Hi,

My site went down and gave a cloudfare error message saying the site:

it is resolving to an IP address that is creating a conflict within Cloudflare’s system.

I have changed passwords and api tokens,

What should I do next?

Thanks,

Hi @bmoj,

That sounds like a 1000 error?

This error is most commonly caused by one or more DNS records in the Cloudflare dashboard pointing to a Cloudflare IP address. It can also be caused if your DNS record(s) reference another reverse proxy. To resolve this, you should edit your DNS records to point to your origin server’s IP address.

More details in this Community Tutorial:

And this support article:

Thanks, I’ll look into it.

Checking the audit log, I see a suspicious log ‘Domain moved’. It doesn’t give much details about this. Could it be an automatic thing?

It shouldn’t be. Does the domain show as active or moved in your dashboard?

It says “pending nameserver update”, which I didn’t initiate in my registrar.

We’re you trying to move the site to a new account? Can you share the domain and the nameserver pair it is asking you to change to?

Is it safe to share that stuff on a public forum?

It is up to you, the nameservers attached to a domain are not private. It makes it easier for us to troubleshoot if you can share the website in question, but we understand if you can’t and will help as best we can.

Thanks.

On the domain overview page, if it says pending nameserver update, it should show you a screen asking you to change your nameservers from one pair to another. Which is it asking you to change to?

right, so:

demi.ns.cloudflare.com
ricardo.ns.cloudflare.com

OK, thanks. Have you recently added the domain to that account or has it been working there up until now?

The domain currently points to a different pair (angela and jeff). So it is active in a different Cloudflare account.

If you are trying to move the domain from another account to yours, have you updated the nameservers to demi and ricardo? If you have and it’s not working, it is probably as a result of these statuses on your domain, you may want to contact the domain registrar to resolve these.

clientDeleteProhibited http://www.icann.org/epp#clientDeleteProhibited
clientRenewProhibited http://www.icann.org/epp#clientRenewProhibited
clientTransferProhibited http://www.icann.org/epp#clientTransferProhibited
clientUpdateProhibited http://www.icann.org/epp#clientUpdateProhibited

I have not personally tried to change the nameservers to angela and jeff - so it could be that someone has gained access to registrar.

In order to change nameservers back to demi and ricardo - I am not the owner of the account so cannot do that straight away - it asks for 2 factor auth to change nameservers.

Oh, OK. So it has been active and working on your account up until now, and you see the moved notice in your Audit log?

If this is the case, it does indeed suggest that someone else has changed the nameservers to point to another account. I think this is something you will need to follow up on with the registrar (or whoever has contact with them) to get the account there secured and the nameservers changed back to the ones on your account.

Yeah, I’ll do that asap. Thanks a lot for your help

1 Like

No problem, please just let us know if you need any further assistance, I hope you get it resolved soon.

Hi again, so my colleague apparently received an email (Status Active) asking her to change the nameservers due to the domain (top level domain) being activated - which she did. The site was displaying on the staging subdomain. Any ideas why it would want us to change the nameservers?

I’m not entirely sure what that is referring to. Once a domain is active on your account, you shouldn’t need to change the nameservers unless you are moving it to a new account. Do you control the Cloudflare account with that domain on the nameservers you were asked to change them to?

Was that an email from Cloudflare? If so, would you be able to post a screenshot of it, redacting any sensitive info?

Screenshot 2020-11-01 at 22.37.34

So I set the domain up in Cloudfare a while ago in September, and it has been working fine until now.

sorry, it looks like it didn’t ask her to change the nameservers but notified her of the change

So that’s the activation of the domain on the new account, which suggests the account is yours (or on an email address you control). Did you intend to move it to a new account and make the nameserver change or does it still look like someone else did that?

If it’s unexpected and you want the domain to remain in the original account, you should make sure the nameservers are changed back and look into how they were changed if it wasn’t you.

1 Like