The target server, saying it cannot serve this authority.
421 — Misdirected Request
The connection reached a server that is not configured for the host you asked for. It is an HTTP/2 problem in practice: HTTP/2 reuses one connection for multiple hosts that share a certificate, and if the far end disagrees about that sharing, it answers 421.
A proxy does not fix this. This is about connection reuse and TLS naming, not about reputation or geography. Rotating IPs can even mask it intermittently, which makes it harder to find.
Why it happens
HTTP/2 connection coalescing across hosts that share a certificate but not a backend.
An SNI mismatch — the TLS handshake named one host and the request named another.
A proxy rewriting the Host header without reopening the connection.
How to fix it
- Force HTTP/1.1 to confirm the diagnosis: if 421 disappears, it was coalescing.
- Open a separate connection per host rather than reusing one.
- Check that any Host override you set matches the SNI the handshake used.
FAQ
What does 421 mean?›
The connection reached a server that is not configured for the host you asked for. It is an HTTP/2 problem in practice: HTTP/2 reuses one connection for multiple hosts that share a certificate, and if the far end disagrees about that sharing, it answers 421. The target server, saying it cannot serve this authority.
Why am I getting 421?›
HTTP/2 connection coalescing across hosts that share a certificate but not a backend. An SNI mismatch — the TLS handshake named one host and the request named another. A proxy rewriting the Host header without reopening the connection.
How do I fix 421?›
Force HTTP/1.1 to confirm the diagnosis: if 421 disappears, it was coalescing. Open a separate connection per host rather than reusing one. Check that any Host override you set matches the SNI the handshake used.
Will a proxy fix 421?›
This is about connection reuse and TLS naming, not about reputation or geography. Rotating IPs can even mask it intermittently, which makes it harder to find.