cloudflare/cloudflared · error

invalid %s provided: %w

Error message

invalid %s provided: %w

What it means

The `--virtual-dns-service-resolver-addresses` flag accepts a list of resolver addresses; parseResolverAddrPorts validates each as a valid addr:port. Any malformed entry aborts startup, wrapping the parse error in this message with the flag name.

Source

Thrown at cmd/cloudflared/tunnel/configuration.go:220

		resolvedRegion = endpoint
	}

	warpRoutingConfig := ingress.NewWarpRoutingConfig(&cfg.WarpRouting)

	// Setup origin dialer service and virtual services
	originDialerService := ingress.NewOriginDialer(ingress.OriginConfig{
		DefaultDialer:   ingress.NewDialer(warpRoutingConfig),
		TCPWriteTimeout: c.Duration(flags.WriteStreamTimeout),
	}, log)

	// Setup DNS Resolver Service
	originMetrics := origins.NewMetrics(prometheus.DefaultRegisterer)
	dnsResolverAddrs := c.StringSlice(flags.VirtualDNSServiceResolverAddresses)
	dnsService := origins.NewDNSResolverService(origins.NewDNSDialer(), log, originMetrics)
	if len(dnsResolverAddrs) > 0 {
		addrs, err := parseResolverAddrPorts(dnsResolverAddrs)
		if err != nil {
			return nil, nil, fmt.Errorf("invalid %s provided: %w", flags.VirtualDNSServiceResolverAddresses, err)
		}
		dnsService = origins.NewStaticDNSResolverService(addrs, origins.NewDNSDialer(), log, originMetrics)
	}
	originDialerService.AddReservedService(dnsService, []netip.AddrPort{origins.VirtualDNSServiceAddr})

	tunnelConfig := &supervisor.TunnelConfig{
		ClientConfig:    clientConfig,
		GracePeriod:     gracePeriod,
		EdgeAddrs:       c.StringSlice(flags.Edge),
		Region:          resolvedRegion,
		EdgeIPVersion:   edgeIPVersion,
		EdgeBindAddr:    edgeBindAddr,
		HAConnections:   c.Int(flags.HaConnections),
		IsAutoupdated:   c.Bool(flags.IsAutoUpdated),
		LBPool:          c.String(flags.LBPool),
		Tags:            tags,
		Log:             log,
		LogTransport:    logTransport,

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Provide each entry as a literal IP with port, e.g. `1.1.1.1:53` or `[2606:4700:4700::1111]:53`.
2. Repeat the flag once per address instead of comma-joining if your shell/config splits incorrectly.
3. Remove the flag entirely to use the default DNS resolver service dialer.

Example fix

// before
virtual-dns-service-resolver-addresses: ["one.one.one.one:53"]
// after
virtual-dns-service-resolver-addresses: ["1.1.1.1:53"]

// shell: pre-validate each resolver addr:port
for a in $RESOLVER_ADDRS; do
  host="${a%:*}"; port="${a##*:}"
  [[ "$host" =~ ^[0-9.]+$ || "$host" == *:* ]] && [[ "$port" =~ ^[0-9]+$ ]] || { echo "bad resolver $a"; exit 1; }
done

When it happens

Trigger: Passing `--virtual-dns-service-resolver-addresses` entries that are not valid `ip:port` values (missing port, bad IP, extra characters, hostnames instead of IPs).

Common situations: Users specifying DNS hostnames (e.g. 1.1.1.1:53 vs dns.example.com:53), forgetting the port, or using comma-separated values where the flag expects repeated/slice syntax.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• dns-proxy feature is no longer supported
• too many addresses provided, max: 10
• No configuration file was found. Please create one, or use t
• ErrNoIngressRulesCLI
• Did not receive final destination from client. The --destina

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/6b0d0c199cefddbf. Report an issue: GitHub.