Cloudflare Error 1014: CNAME Cross-User Banned

What’s actually happening

A site or subdomain throws a Cloudflare 1014 page instead of loading. It happens when your orange-clouded CNAME points at a hostname that lives on someone else's Cloudflare zone — Cloudflare won't proxy one customer's traffic through another customer's account without an explicit allow. Often shows up right after pointing a custom domain at a SaaS vendor, or attaching a custom domain to an R2 bucket.

Common causes

• A proxied CNAME on your account targets a hostname that is itself proxied on a different Cloudflare account, and the target account hasn't authorized it
• The SaaS provider you're CNAME'ing to hasn't onboarded your hostname through Cloudflare for SaaS (custom hostnames)
• Attaching a custom domain to an R2 bucket whose zone is on a held, banned, or different account
• Both your zone and the destination are on Cloudflare with the orange cloud on, with no Cloudflare for SaaS relationship linking them
• Pointing at a partner/vendor endpoint that expects to be reached by a CNAME but only for hostnames it has explicitly provisioned

How to fix it

1. Have the target enable Cloudflare for SaaS for your hostnameIf you're pointing at a vendor, they need to add your custom hostname under SSL/TLS > Custom Hostnames (Cloudflare for SaaS) on their side. Once your hostname is provisioned there, the cross-account CNAME is allowed and 1014 clears.
2. Grey-cloud the record (DNS only)In your Cloudflare DNS, click the orange cloud on the CNAME so it turns grey. That stops Cloudflare from proxying it; the lookup resolves straight to the target and the cross-user proxy block no longer applies. You lose Cloudflare's proxy features on that record.
3. Point at an A record / real origin IP insteadIf the destination publishes a stable origin IP, use an A record to that IP rather than a CNAME to their proxied hostname. This sidesteps the cross-account proxy entirely.
4. For R2, check the zone's account statusIf this is an R2 custom domain, confirm the domain's zone isn't on a held or banned account and that the zone and bucket are under accounts permitted to link. Move the domain into the correct account or clear the hold, then re-add the custom domain.