421 Misdirected Request

Meaning & Description

Common Causes

• A shared TLS certificate covering both `a.example.com` and `b.example.com`, but the server for `a` cannot serve `b`. The browser reuses the connection for `b`, resulting in a 421.
• Misconfigured load balancers sending traffic to a backend pool that lacks the proper virtual host definition.
• DNS points to the correct IP, but the web server (like Nginx or Apache) does not have a `server_name` or `VirtualHost` matching the request.

How to fix a 421 error

1. Check your TLS certificates. If you use wildcard certs, ensure the backend server receiving the traffic can actually serve all subdomains, or disable connection coalescing.
2. Verify that your load balancer or reverse proxy is sending the correct `Host` header to the backend.
3. Check the `server_name` (Nginx) or `ServerName` (Apache) directives in your web server configuration.

Browser & SEO Behaviour

Code Examples

HTTP/2 421 Misdirected Request
Content-Type: text/plain

Server not configured for this domain.

app.use((req, res, next) => {
  const allowedHosts = ["api.example.com"];
  if (!allowedHosts.includes(req.hostname)) {
    return res.status(421).send("Misdirected Request");
  }
  next();
});

from fastapi import FastAPI, Request, HTTPException

app = FastAPI()

@app.middleware("http")
async def verify_host(request: Request, call_next):
    if request.url.hostname != "api.example.com":
        from fastapi.responses import PlainTextResponse
        return PlainTextResponse("Misdirected Request", status_code=421)
    return await call_next(request)

func handler(w http.ResponseWriter, r *http.Request) {
    if r.Host != "api.example.com" {
        http.Error(w, "Misdirected Request", 421)
        return
    }
    w.WriteHeader(http.StatusOK)
}

public class HostFilteringMiddleware
{
    private readonly RequestDelegate _next;
    public HostFilteringMiddleware(RequestDelegate next) => _next = next;

    public async Task Invoke(HttpContext context)
    {
        if (context.Request.Host.Host != "api.example.com")
        {
            context.Response.StatusCode = 421;
            await context.Response.WriteAsync("Misdirected Request");
            return;
        }
        await _next(context);
    }
}

# Passing a Host header the server does not recognize
curl -H "Host: unknown.com" https://api.example.com

Raw HTTP Response Example

HTTP/2 421 Misdirected Request
Date: Wed, 21 Oct 2026 07:28:00 GMT
Content-Type: text/plain

Server is not authoritative for this domain.

Real-world Examples

Frequently Asked Questions

Developer Tips

• If you are hosting multiple microservices behind a single wildcard TLS certificate, ensure your ingress controller correctly routes traffic, or use 421 to force clients to split their connections.
• Always use a default "catch-all" virtual host block in your web server that returns a 421 (or 444 in Nginx) to drop traffic for unrecognized domains.

Interview Questions

These are questions you might face in a backend or API design interview that touch on HTTP 421.