What causes "too many addresses provided, max: 10" in cloudflare/cloudflared?

Reduce the resolver list to 10 or fewer addresses.

too many addresses provided, max: 10

Error message

too many addresses provided, max: 10

What it means

parseResolverAddrPorts enforces a hard cap of 10 statically configured resolver addresses for the resolver service. If the resolver address input contains more than 10 entries, it returns this error before parsing any of them.

Source

Thrown at cmd/cloudflared/tunnel/configuration.go:508

		IP:   dst,
		Port: port,
	})
	if err != nil {
		return netip.Addr{}, err
	}
	defer func() { _ = udpConn.Close() }()
	localAddrPort, err := netip.ParseAddrPort(udpConn.LocalAddr().String())
	if err != nil {
		return netip.Addr{}, err
	}
	localAddr := localAddrPort.Addr()
	return localAddr, nil
}

func parseResolverAddrPorts(input []string) ([]netip.AddrPort, error) {
	// We don't allow more than 10 resolvers to be provided statically for the resolver service.
	if len(input) > 10 {
		return nil, errors.New("too many addresses provided, max: 10")
	}
	addrs := make([]netip.AddrPort, 0, len(input))
	for _, val := range input {
		addr, err := netip.ParseAddrPort(val)
		if err != nil {
			return nil, err
		}
		addrs = append(addrs, addr)
	}
	return addrs, nil
}

View on GitHub (pinned to 2253eeeb25)

Solutions

Reduce the resolver list to 10 or fewer addresses.
Point cloudflared at a single local forwarder (e.g. unbound/dnsmasq) that fans out to the full resolver set.
Dynamically discover resolvers instead of static configuration if your setup supports it.

Example fix

# before
resolvers:
  - 10.0.0.1:53
  - 10.0.0.2:53
  # ... 15 entries total
# after: keep at most 10 entries, or use one upstream forwarder
resolvers:
  - 10.0.0.1:53
  - 10.0.0.2:53

Defensive patterns

Strategy: validation

Validate before calling

const resolvers = cfg.resolvers ?? [];
if (resolvers.length > 10) throw new Error(`resolvers must be <= 10, got ${resolvers.length}`);

Prevention

Keep static resolver lists at 10 entries or fewer.
Use a local DNS forwarder to scale beyond 10 upstreams.
Validate resolver lists in config-generation tooling before writing them.

When it happens

Trigger: Passing more than 10 resolver address:port entries via the resolver configuration flag when preparing tunnel config.

Common situations: Enterprises mirroring all internal DNS resolvers into cloudflared; config files with an over-long resolver list generated by tooling.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/526d6f7e12a80e73. Report an issue: GitHub.