Correct HTTP response for domain not found

If the server does not recognise the domain is 404 correct?

[graeme_p]

I have code that runs multiple sites, so it uses the domain to decide what content to serve.

If it does not recognise the domain it returns a 404.

This seems to be correct as the definition is:

The server has not found anything matching the Request-URI. No indication is given of whether the condition is temporary or permanent. The 410 (Gone) status code SHOULD be used if the server knows, through some internally configurable mechanism, that an old resource is permanently unavailable and has no forwarding address. This status code is commonly used when the server does not wish to reveal exactly why the request has been refused, or when no other response is applicable.

[w3.org...]

It says URI, not path, so it looks correct. On the other hand, it does not feel right to give no indication that you have the domain wrong rather than the path. I cannot see any more appropriate response, short of 418...

[keyplyr]

Is this about server response or what the user sees? If the later, you could set up a custom 404 page for each domain giving more complete info.

[lammert]

Besides the technical question how to respond to traffic, you should also question yourself where the traffic is coming from. If it is a significant amount of human traffic which you receive through non existent domains (I assume these are sub domains?) you may try to monetize it as well. If the traffic is mainly bots and you want to send them away permanently then just dropping the packet and not responding at all would be the best solution IMHO. The domain does not exist, has probably never been active so why send HTTP status codes for something which isn't there in the first place? Sending status codes costs your resources and gives the impression to the bots that something is there which will make them try again in the future. I know of no single bot which doesn't re-request an URL after they have been fed a 404 or 410 status code.

[lucy24]

On the other hand, it does not feel right to give no indication that you have the domain wrong rather than the path. I cannot see any more appropriate response, short of 418...

Who is the visitor? Do you have any indication that requests for the wrong domain are coming from bona fide humans, rather than from malign robots? (If they're from select regions such as Brazil or Russia, even an apparent human is more likely to be an infected browser.) If so, can you pinpoint the referer responsible for sending them to the wrong place? People don't just make up domain names out of a hat; there's got to be a DNS pointing to your server or they wouldn't arrive in the first place.

The ordinary way to handle requests for the wrong domain name is to 301 redirect to the correct name. If for some reason you don't want to do this (essentially you're telling the malign robot what domain “really” lives at their requested IP), then a 404 is generally the best response. It's like returning a manual 404 response to requests for login.php: the robot receives absolutely no information other than that these aren't the droids you're looking for. If, on the other hand, you return a 403 or 418 or 4-almost-anything, the robot may get suspicious and wonder what you're hiding.

[graeme_p]

I actually have more than one system with these issues. I think they require different responses (because where the traffic is coming from etc. differs)