If one Dokku app answers when you visit unrelated hostnames, fix the problem at three separate layers: the app’s registered domains, DNS records, and nginx’s fallback virtual host. Start with dokku domains:report APP, replace the app’s domain list with dokku domains:set (or disable its vhost), then make nginx reject unknown Host values instead of sending them to the first site.
Antihost offers VPS plans with one-click Docker, NVMe storage and a 14-day free trial.
What “every domain” means in Dokku
Dokku does not normally publish one application to every name merely because several names resolve to the same server. Three decisions occur in sequence:
As an Amazon Associate I earn from qualifying purchases.
- DNS resolution: a DNS record determines whether a hostname reaches the Dokku machine. A wildcard record can send many otherwise-unlisted names to that host.
- Dokku domain registration: each app has a list of domains for which Dokku generates a virtual host. Dokku also has a global domain value used as the default top-level domain when constructing app hostnames. Dokku describes this value as “a default TLD for all applications on a host.”
- nginx Host-header matching: once the request reaches the server, nginx compares the HTTP
Hostheader with its configured server names. If no name matches, nginx’s default behavior can route the request to the lexicographically first site in the nginx configuration stack.
That last fallback is why a request for an unknown name can appear to “deploy” or serve the first Dokku app. The app was not necessarily registered for that hostname; nginx simply found no better match. Correcting only one layer can leave the symptom in place. For example, removing a wildcard DNS record prevents public resolution for new names, but it does not protect the server when a request is sent directly to its IP with an arbitrary Host header.
Diagnose the effective domains before changing anything
Run the domains report
For the affected app, run:
dokku domains:report APP
Replace APP with the Dokku app name. Review both fields reported as Domains app vhosts and Domains global vhosts. The first shows names specifically associated with that app; the second shows host-wide domain behavior inherited from Dokku’s global configuration. Do not assume that the name you remember deploying is the complete effective list.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Save the output before editing the configuration. It gives you a precise before-and-after comparison and helps identify whether the unexpected name is app-specific or coming from the host-wide default domain.
Classify the symptom
- One app lists several unintended names: its app-level domain list needs to be replaced or cleared.
- The app has no intended public URL: its nginx virtual host should be disabled rather than left with an accidental name.
- Many random names reach the same server and the app is not listing them: investigate wildcard DNS and nginx’s unmatched-host fallback.
- The name is correct but the service is unreachable after a change: check port mappings and certificates, particularly if the app uses a non-standard port.
This classification matters because DNS, Dokku registration, and nginx matching are different controls. A DNS change cannot remove a Dokku vhost, and a Dokku domain change cannot stop a wildcard record from resolving a name to the host.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Set the app’s domain list explicitly
Use domains:set when specific names should remain public
If the app should answer only for one or more known names, set the complete list in one command:
dokku domains:set APP example.com www.example.com
This command replaces the app’s existing domain list; it does not append to it. Include every hostname that should remain valid, including a www name only if you actually intend to serve it. Omitting an old or accidental name removes it from the app-level registration.
After setting the list, deploy the app again so Dokku regenerates its nginx configuration with the replacement names. Then run dokku domains:report APP again and verify the app-vhost field contains only the intended entries.
Use domains:clear when no app-specific names should remain
To remove all app-specific domains, run:
dokku domains:clear APP
This removes the names registered directly on the app. It is appropriate when you are cleaning up stale hostnames before assigning a new set, or when the app should no longer have app-specific aliases. Clearing the list is not the same as disabling the app’s nginx virtual host: if the app still has a generated public route through other configuration, inspect the report and deployment result before assuming it is unreachable.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Choose the command by intended availability
| Desired state | Command | Result | Follow-up |
|---|---|---|---|
| Serve selected public names | dokku domains:set APP DOMAIN... |
Replaces the complete app domain list | Deploy again, then verify the report and test each intended hostname |
| Remove app-specific names | dokku domains:clear APP |
Deletes the app’s registered domain entries | Confirm the resulting vhost state; clear DNS records that should no longer resolve |
| Do not publish the app through nginx | dokku domains:disable APP |
Marks the app’s nginx virtual host for removal on subsequent deploys | Deploy again so the generated virtual host is discarded |
Disable routing for an app that should not be public
If the application is an internal worker, a staging component reachable only through another proxy, or a service that should have no public Dokku hostname, use:
dokku domains:disable APP
Dokku’s documented behavior is that “on subsequent deploys, the nginx virtualhost will be discarded.” The deploy is therefore part of the change, not an optional cleanup step. Run a deployment after disabling the domains feature, then inspect the generated configuration through the domains report and test that the old hostname no longer serves the app.
Disabling the vhost does not rewrite DNS. If a wildcard record still points arbitrary names at the machine, those requests can continue reaching nginx; they should be handled by the server-wide default described below. Likewise, disabling one app does not change the domain registrations of other apps.
Control wildcard DNS separately
Dokku’s advanced installation guidance commonly uses a wildcard domain record pointing to the host running Dokku. This is convenient for automatically constructed app hostnames, but it means that many names resolve to the same server whether or not an app has explicitly registered each one.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallReview the authoritative DNS zone for the affected domain and identify wildcard records such as a record that matches every subdomain. If wildcard behavior is not part of your design, remove it. If only a limited set of names should reach Dokku, replace the broad record with explicit records for those names or with a narrower wildcard scope that matches your naming plan.
DNS changes can take time to appear through recursive resolvers according to the record’s TTL. During that interval, some clients may continue using the previous answer. Test from a resolver that has refreshed and, when troubleshooting the server itself, send a request with an explicit Host header so you can distinguish DNS caching from nginx routing.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Remember the boundary: DNS decides the destination IP, not which Dokku app receives the request. Even with a wildcard record, nginx should select an app only when its server name matches the request. Conversely, removing DNS does not stop a direct request to the host from carrying an arbitrary name.
Install a safe nginx default virtual host
Why the fallback must be changed
When no configured server name matches the incoming Host value, nginx selects a default server for the listening address and port. Dokku’s nginx documentation notes that, by default, an unknown host can be routed to the lexicographically first site in the configuration stack. That makes the first app look like a catch-all even though its domain list is correct.
Recommended Free Tools
Create an explicit default server that returns an intentional error before nginx reaches a Dokku site. This protects against typos, stale DNS, wildcard names you did not register, and direct requests with forged host headers.
Create the port-80 default
Create /etc/nginx/conf.d/00-default-vhost.conf with the following contents:
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _;
access_log off;
return 410;
}The 00- prefix is intentional: the file must load before /etc/nginx/conf.d/dokku.conf so this server is selected as the default for unmatched HTTP requests. After writing the file, reload nginx:
service nginx reload
A response of HTTP 410 tells clients that the requested resource is intentionally unavailable. Dokku’s nginx guidance also documents return 444 as an alternative; nginx closes the connection without sending a normal HTTP response. Choose one behavior and document it for your monitoring and incident response.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Validate the result
- Request an intended hostname and confirm it still reaches its registered app.
- Request an unregistered hostname that resolves to the server and confirm it receives the chosen rejection behavior instead of an app response.
- Repeat the test with an explicit IP address and arbitrary
Hostheader to verify that direct traffic does not fall through to the first app. - Check nginx’s error and access behavior if the response is not what you expect; a configuration-order problem usually means the default file loaded after Dokku’s configuration.
Account for ports and TLS after a domain change
Changing domain registrations can affect port mappings, especially when an app uses non-standard ports. Before changing names, record how clients currently reach the service and which external port is expected. After the deploy, verify that the new hostname points to the same intended listener and that any proxy or firewall rule still forwards to the app’s mapped port.
Do not treat a successful DNS lookup as proof that the application is reachable. Test the complete path: name resolution, TCP connection to the expected port, nginx virtual-host selection, and the application response. If the app moved from a custom port or relies on a proxy-only mapping, the domain list may be correct while the service remains inaccessible because the port relationship was not updated.
HTTPS introduces a second name-sensitive layer. A certificate must cover every hostname you retain, and a hostname removed from the app should not remain presented as a valid public route through an old proxy configuration. Reissue or adjust certificates and proxy rules whenever the set of public names changes. The exact certificate mechanism depends on your Dokku and nginx setup; the important operational check is that certificate names, vhost names, DNS records, and port mappings describe the same set of hosts.
A complete repair sequence
Use this order when you need a repeatable fix rather than an isolated command:
- Capture the current state. Run
dokku domains:report APPand record both app and global vhost fields. Note the DNS records and the ports clients use. - Define the intended exposure. Decide whether the app should serve a specific list of public names, have no app-specific names, or have no public nginx vhost at all.
- Apply the app-level setting. Use
dokku domains:set APP ...for an explicit list,dokku domains:clear APPto remove app entries, ordokku domains:disable APPwhen the app should not be publicly routed. - Deploy when required. A replacement list must be reflected in generated configuration, and a disabled domains feature removes its nginx virtual host on a subsequent deploy.
- Recheck Dokku’s view. Run the domains report again and confirm that the effective app-vhost entries match the decision made in step two.
- Correct DNS scope. Remove or narrow an unintended wildcard record; retain it only when automatic subdomain resolution is deliberate.
- Harden unmatched traffic. Install the ordered nginx default server, reload nginx, and verify that unknown hosts return the selected rejection response.
- Retest dependencies. Check ports, proxies, and TLS names for every hostname that remains public. Test both a valid name and an unknown name.
Common failure modes and their fixes
The old hostname still serves the app after domains:set
The command replaces Dokku’s list, but the generated nginx configuration may not reflect the new list until a deployment. Deploy again, rerun the domains report, and test after nginx has reloaded. If the old name still resolves, remove its DNS record as a separate cleanup step.
Every random subdomain still reaches the machine
A wildcard DNS record may still direct those names to the host. DNS resolution alone does not prove that Dokku registered them. Keep or narrow the wildcard only if it is intended, and rely on the explicit nginx default server to reject names that do not match a configured vhost.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Disabling domains appears to do nothing
dokku domains:disable APP takes effect for the generated nginx virtual host on a subsequent deploy. Perform that deploy, then inspect the report and test the previous URL. If the hostname still reaches another app, that is a separate nginx or domain-registration issue.
The default file exists but the first app remains the catch-all
Check load order. The default file must load before /etc/nginx/conf.d/dokku.conf, and both IPv4 and IPv6 port-80 listeners should be covered as shown. Reload nginx after correcting the order. A default server on one address family does not automatically govern the other.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The app works on its old port but not through the new name
Review the app’s port mapping and any intermediary proxy or firewall rule. Domain changes can affect mappings for non-standard ports; verify the external port, upstream destination, and TLS configuration instead of troubleshooting DNS alone.
A valid hostname receives the rejection response
Compare the exact hostname, including any www prefix, with the entries shown by dokku domains:report APP. The name must be in the app’s complete list, DNS must point to the Dokku host, and nginx must have been regenerated after the change. A spelling difference is an unmatched-host request and will correctly hit the default server.
How to choose the right boundary for the fix
| Problem observed | Primary control | What it changes | What it does not change |
|---|---|---|---|
| App has unwanted registered names | Dokku domains plugin | The app’s generated vhost names | DNS records or other apps’ vhosts |
| Names that should not exist resolve to the host | Managed DNS | Which names reach the Dokku IP | nginx’s response to a direct request |
| Unknown names fall into the first app | nginx default server | Response for unmatched Host headers |
Whether a name resolves in DNS |
| App should be internal or proxy-only | dokku domains:disable APP |
Removal of the app’s generated nginx vhost after deployment | Internal networking, DNS records, or another proxy’s configuration |
| Service breaks after renaming | Port and TLS configuration | Reachability and certificate coverage for retained names | The domain list itself unless you change it separately |
The durable solution is usually layered: make the app’s list exact, make DNS no broader than necessary, and make nginx reject anything that still arrives without a matching name. That combination prevents both accidental exposure and misleading “first app” responses.
Quick Recap
Operational checklist
- Run
dokku domains:report APPbefore and after changes. - Read both app-vhost and global-vhost values; do not inspect only the hostname you expected.
- Use
domains:setwhen the desired list is known, because it replaces rather than appends. - Use
domains:clearto remove app-specific entries anddomains:disablewhen no public Dokku vhost should exist. - Deploy after changes that require regenerated nginx configuration.
- Audit wildcard DNS independently from Dokku’s domain list.
- Load an nginx
default_serverbefore Dokku’s configuration and return410or444for unknown hosts. - Reload nginx and test valid, invalid, wildcard-resolved, and direct-IP requests.
- Recheck non-standard port mappings and TLS certificate names whenever public domains change.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
