Guide: Resolving "421 Invalid Host Header" (DNS Rebinding Protection)

@leoswing

Context

A recent update (Commit: 86bb54c, PR: #861) introduced DNS rebinding protection to the MCP Python SDK. While this improves security, it may cause existing setups to fail with a 421 Misdirected Request / Invalid Host Header error if the host header doesn't match the allowed list (common when using proxies, gateways, or custom domains).

Affected Components

File: src/mcp/server/fastmcp/server.py:178

Solutions

Depending on your security requirements, you can resolve this in two ways:

Option 1: Explicitly Allow Specific Hosts (Recommended)

Use this approach if you are running in production or through a gateway. You can wildcard the ports using *.

from mcp.server.fastmcp import FastMCP
from mcp.server.transport_security import TransportSecuritySettings

mcp = FastMCP(
    "MyServer",
    transport_security=TransportSecuritySettings(
        enable_dns_rebinding_protection=True,
        # Add your specific gateway or domain here
        allowed_hosts=["localhost:*", "127.0.0.1:*", "your-gateway-host:*"],
        allowed_origins=["http://localhost:*", "http://your-gateway-host:*"],
    )
)

Option 2: Disable DNS Rebinding Protection

Use this approach for local development or if you are managing security at a different layer of your infrastructure.

from mcp.server.fastmcp import FastMCP
from mcp.server.transport_security import TransportSecuritySettings

mcp = FastMCP(
    "MyServer",
    transport_security=TransportSecuritySettings(
        enable_dns_rebinding_protection=False,
    )
)

References

Original Reported by: @leoswing in Add support for DNS rebinding protections #861
Then Reported by: @longz30 in 1.24.0出现报错 #1797

Note: If you are using a reverse proxy (like Nginx or Caddy), ensure your proxy is passing the correct Host header to the MCP server.

Additional Context

If your problem is solved, remember to give a thumbs up 👍!

@cbcoutinho

@cbcoutinho @jerome3o-anthropic @maxisbey I suggest adding some documents for Invalid Host Header. Because this kind of problem often occurs in the cluster deployment.

Yep I agree, adding documentation around this would be a really good idea!

fix: configure TransportSecuritySettings for production Host validation

fix modelcontextprotocol/python-sdk#1798

Fix DNS rebinding protection for reverse proxy

fix: disable DNS rebinding protection for reverse proxy deployment

Can any env vars currently configure for this, like MCP_ALLOWED_HOSTS and MCP_ALLOWED_ORIGINS ?

+1 to above: it'll be nice if there is a set centralised env vars defined specifically for these configs:

As seen there are more linked issues to this one, with the solution that adding configs / envvars that are mcp servers specific. Having centralised set of env vars can prevent mcp servers implementing customised configs / envvars, saving efforts.

fix: Disable DNS rebinding protection for reverse proxy deployments

@ddworken

@ddworken @jerome3o-anthropic There really needs to be a better mechanism to set this globally/environmentally beyond passing transport_security to every server instance.

Looking at the growing list of linked issues and commits referencing this problem, it's clear this is causing significant friction for users deploying MCP servers in production environments (Kubernetes clusters, reverse proxies, gateways, etc.).

As other users mentioned above, having standardized environment variables like MCP_ALLOWED_HOSTS, MCP_ALLOWED_ORIGINS, and MCP_DNS_REBINDING_PROTECTION would be extremely valuable.

We ran into this same issue in our MCP server (nextcloud-mcp-server) where we mount FastMCP to a Starlette application for Docker/Kubernetes deployments.

The key issue for this deployment pattern:

When you use mcp.streamable_http_app() or mcp.sse_app() and mount it to a larger Starlette/FastAPI application, there's a disconnect between the web server's bind address and FastMCP's host parameter:

Uvicorn bind address (--host 0.0.0.0): Where the HTTP server listens (set via CLI/Dockerfile)
FastMCP host parameter (defaults to 127.0.0.1): Used for auto-enable logic

Since FastMCP defaults host="127.0.0.1" regardless of how uvicorn is configured, the auto-enable triggers even for servers explicitly bound to 0.0.0.0 for container deployments.

Our workaround:

transport_security=TransportSecuritySettings(enable_dns_rebinding_protection=False)

Suggestions for the SDK:

Environment variable support (as others mentioned): MCP_ALLOWED_HOSTS, MCP_ALLOWED_ORIGINS, MCP_DNS_REBINDING_PROTECTION would help containerized deployments configure this without code changes.
Documentation for mounted apps: When using streamable_http_app() or sse_app(), the host parameter doesn't control where the app listens - that's controlled by uvicorn/gunicorn. Consider documenting this distinction.
Consider detection logic: Could the middleware inspect the actual request origin rather than relying on the host parameter? Or perhaps only auto-enable when the app is run via mcp.run() rather than mounted?

Security note: For containerized deployments, DNS rebinding protection may be inappropriate anyway - requests come via Kubernetes service DNS (service.namespace.svc.cluster.local), ingress controllers, or load balancers with varying Host headers. Network-level isolation and OAuth authentication are typically the security boundaries instead.

See our fix: https://github.com/cbcoutinho/nextcloud-mcp-server/blob/master/docs/MCP-1.23-DNS-REBINDING-FIX.md

docs: Add troubleshooting guide for 421 Invalid Host Header error

Fix 421 Invalid Host header: disable DNS rebinding protection for clo…

Add workaround for default allowed hosts

@maxisbey

This kind of annoying behavior is expected when enforcing security on the wrong layer. I'm still against the TransportSecurity object, as I was in the PR that introduced it.

@maxisbey @pcarleton this issue has a lot of thumbs up, can you please take a look?

mcp: disable DNS rebinding protection (handled at OAuth + CF layer)

This kind of annoying behavior is expected when enforcing security on the wrong layer. I'm still against the TransportSecurity object, as I was in the PR that introduced it.

@maxisbey @pcarleton this issue has a lot of thumbs up, can you please take a look?

At the very least allow us to configure it with our own allowed_hosts and allowed_origins (or gasp disable it with a simple switch in a trusted environment) without reverse engineering and rebuilding every MCP container out there that uses this stuff. My LLM and agents run in separate containers, and as it is now I cannot use any MCP server container that's built on this library.

fix: disable MCP DNS rebinding protection to resolve 421 Invalid Host…

docs: retitle hand-offs and link text to match the new nav

Thanks for the report. Closing this as it's been fixed in v2, which is now released (see #3044). Feel free to reopen if you still hit it on v2.

_{AI Disclaimer}

feat: add FASTMCP_ALLOWED_HOSTS, FASTMCP_ALLOWED_ORIGINS, FASTMCP_TRA…

fix: no Host allowlist needed for HTTP; decide the policy explicitly

Navigation Menu

Repository navigation

Guide: Resolving "421 Invalid Host Header" (DNS Rebinding Protection) #1798

Context

Affected Components

Solutions

Option 1: Explicitly Allow Specific Hosts (Recommended)

Option 2: Disable DNS Rebinding Protection

References

Additional Context

8 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Guide: Resolving "421 Invalid Host Header" (DNS Rebinding Protection) #1798

Description

Context

Affected Components

Solutions

Option 1: Explicitly Allow Specific Hosts (Recommended)

Option 2: Disable DNS Rebinding Protection

References

Additional Context

Activity

Junyi-99 commented on Dec 17, 2025

maxisbey commented on Dec 18, 2025

princerb commented on Jan 10, 2026

zemin-piao commented on Jan 20, 2026

Maddest-Lad commented on Jan 28, 2026

cbcoutinho commented on Jan 29, 2026

8 remaining items

Kludex commented on Apr 5, 2026

FOTempel commented on May 10, 2026

laozhangzzz commented on Jun 25, 2026

maxisbey commented on Jul 29, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions