What this error means
This message is application-specific. For the Homepage dashboard, current documentation says to read the logged host value and include that exact host in HOMEPAGE_ALLOWED_HOSTS; other products can use the same wording for different validation rules. The browser or proxy message describes the symptom, not necessarily the root cause. HostWithShery therefore checks the application host configuration evidence that can be observed publicly before recommending a configuration change.
Most likely causes
These are the first explanations to test because each can produce this exact symptom. Treat them as hypotheses until the matching public evidence is present.
- The request Host value is not on the application allowlist — Verify the request Host value is not on the application allowlist from the public Internet and compare it with the value the responsible provider says should be live.
- Reverse proxy presents a hostname or port different from the configured value — Verify reverse proxy presents a hostname or port different from the configured value from the public Internet and compare it with the value the responsible provider says should be live.
- Environment-variable change was not applied to the running deployment — Verify environment-variable change was not applied to the running deployment from the public Internet and compare it with the value the responsible provider says should be live.
- The message comes from another product with a different host-validation rule — Verify the message comes from another product with a different host-validation rule from the public Internet and compare it with the value the responsible provider says should be live.
What to check on your domain
Use the embedded scan to compare the failing layer with adjacent layers that can produce the same visible error. This prevents a DNS change from being used to “fix” a TLS problem, or an SSL-mode change from masking an origin failure.
- The request Host value is not on the application allowlist — Verify the request Host value is not on the application allowlist from the public Internet and compare it with the value the responsible provider says should be live.
- Reverse proxy presents a hostname or port different from the configured value — Verify reverse proxy presents a hostname or port different from the configured value from the public Internet and compare it with the value the responsible provider says should be live.
- Environment-variable change was not applied to the running deployment — Verify environment-variable change was not applied to the running deployment from the public Internet and compare it with the value the responsible provider says should be live.
- The message comes from another product with a different host-validation rule — Verify the message comes from another product with a different host-validation rule from the public Internet and compare it with the value the responsible provider says should be live.
- Read the application logs before changing DNS — Verify read the application logs before changing DNS from the public Internet and compare it with the value the responsible provider says should be live.
Fixes in the recommended order
Change the smallest confirmed layer first. Preserve working DNS and mail records, document the current value, apply one repair, and then retest before moving to the next possibility.
- 1. Read the application logs before changing DNS. Confirm the public result after this step before making another unrelated change.
- 2. For Homepage, compare the logged value with HOMEPAGE_ALLOWED_HOSTS. Confirm the public result after this step before making another unrelated change.
- 3. Recreate or restart the deployment as required after configuration changes. Confirm the public result after this step before making another unrelated change.
- 4. If the product is not Homepage, use its own host-validation documentation rather than copying this setting. Confirm the public result after this step before making another unrelated change.
Read the application log before touching DNS
“Host validation failed” is not a universal DNS error. The public check can confirm whether the requested hostname resolves and responds, but the application log identifies the host value that its own validation rejected. For Homepage, compare that logged value with HOMEPAGE_ALLOWED_HOSTS; for another product, follow that product’s documented allowlist or proxy-host rule.
Reverse-proxy and port mismatches matter
The Host value seen by an application can include a hostname or port that differs from what you typed in the browser because of a reverse proxy or container configuration. Compare the logged value with the intended external host before widening an allowlist.
How to confirm the repair
The same public test that exposed the problem should now return a healthy result, without creating a new DNS, TLS, mail or redirect regression.
If the error remains
Capture the checked hostname, exact timestamp, final DNS addresses, redirect/TLS result and the failing public status before escalating. That evidence gives a hosting or provider support team something testable instead of only the browser message. If results differ by resolver or network, include those differences rather than assuming the failure is universal.
What not to change
Do not replace nameservers, delete unrelated mail records, disable security controls, remove IPv6 blindly or purge the entire configuration merely because this message appears. Diagnose the failing layer first; broad changes can turn one isolated fault into several independent faults.
Technical references
These primary standards and provider documents are used to verify the behavior described on this page. Provider dashboards can change, so use the current official value for tenant-specific DNS records rather than copying an example from another account.