Nextcloud · Help

Nextcloud AIO domain validation fails behind a reverse proxy?

AIO reports a domain or reverse-proxy problem? Check DNS, APACHE_PORT and the upstream actually reachable from the proxy.

Source date: 5 November 2026Editorial team: KAN KAI WORKSEditorially updated:

Quick answer

AIO's domain or reverse-proxy error does not identify a single failing stage. Correct public DNS does not prove the reverse proxy can reach the internal AIO service. First document whether the proxy runs on the host or in a container, then compare its upstream, APACHE_PORT and binding from that actual context. In a separate proxy container, localhost refers to the proxy container itself.

Source basis: Q1 · Q2

Applies to
The original case involves Nextcloud AIO, Caddy and connection refused on port 11000. Official configuration distinguishes host proxies, container proxies and special deployment modes.
How to verify the result
The supported AIO domain validation passes; external HTTPS reaches the correct instance, and correlated proxy and AIO logs confirm the intended internal route.
Your first check

Can the proxy container reach the actual AIO upstream on its intended port?

During Nextcloud AIO setup, validation says the domain does not point to this server or the reverse proxy is configured incorrectly. A proxy landing page may still work. The combined message does not yet identify which stage fails between the public domain and the internal AIO service.

A useful clue in the original case

A report involving AIO and Caddy includes connect: connection refused on internal port 11000 at a loopback address. Q1 Official AIO guidance requires the proxy destination and APACHE_PORT to match the deployment. It distinguishes a proxy running directly on the host from one running inside a container. Q2

From a separate proxy container, localhost refers to that container's own environment. Correct public DNS therefore does not prove that the proxy can reach the intended AIO upstream.

Inspect each stage of the route

  1. Document the deployment model. Record where AIO and the proxy run, which container networks they use and the intended Apache port. Follow the AIO documentation variant matching that arrangement.
  2. Compare domain resolution. Check A and, where present, AAAA responses from a suitable external network. Do they identify the intended ingress? An outdated IPv6 address may affect a route different from a successful IPv4 test.
  3. Inspect public ingress. Does HTTPS for this exact domain reach the intended proxy with the expected certificate? Record hostname, response status and log timestamp. An unrelated proxy landing page is not the same route.
  4. Test from the proxy's perspective. In the actual proxy environment, check destination name, address and port. For connection refused, establish whether the expected service listens there and whether the network path is correct. Compare the destination with APACHE_PORT and its configured binding.
  5. Observe the AIO check again. After a justified correction, repeat the supported validation and correlate proxy and AIO logs. If it still fails, the next unsuccessful stage should now be more clearly identified.

Avoid a blanket bypass

Disabling domain validation does not repair an unreachable upstream. Special AIO deployment modes have their own documented requirements; do not copy an exception from a different setup. Expose internal ports only through the intended proxy path instead of publishing them as a general troubleshooting measure.

Retain the final network mapping and a successful external HTTPS check. They provide a useful reference when containers or proxy configuration are later replaced.

Frequently asked questions

Do I need to change DNS records?

Only if resolution points to the wrong ingress. A connection failure between the proxy container and AIO is not explained by assigning a different public IP.

What helps with a handover?

Provide AIO and proxy versions, an anonymised network diagram, DNS results, APACHE_PORT, upstream destination and correlated logs. Exclude secrets from environment variables and certificate files.

Help with this case

We can help isolate the affected process and prepare a controlled next step. Discuss case A0291 with KAN KAI WORKS.

Support with this issue

We investigate Nextcloud using your error message, versions and a narrowly scoped example.

Describe your case →Related service: Data & improvements

Sources

Sources checked on 5 November 2026. Individual reports do not establish general prevalence.