In Virtual Hosting, where does a request that matches no host go?

Short answer

It goes to no vService. There is no default target in Virtual Hosting: in unencrypted traffic, a request whose Host Header matches no list receives 503; on HTTPS, if the SNI matches no domain or the client does not send SNI, the connection is closed. There is no default (catch-all) site option. If all subdomains are expected to land somewhere, a wildcard pattern (*.example.com) is added to the relevant vService.

How Does It Work?

Situation	Result
Unencrypted request, Host is in no list	503 (TR7's built-in response; the custom error page of the vService is not used)
Unencrypted request with an IP address (http://203.0.113.10/)	If the IP in the Host is not written in any list, it does not match → 503
HTTPS, SNI is in no list	The connection is closed; the TLS handshake is not completed
HTTPS, with an IP address (https://203.0.113.10/)	The client does not send SNI → the connection is closed
The request reached a vService but did not match the conditions inside it	It goes to the Default Backend Services list of that vService; if the list is empty, 503

The last row separates two stages: Virtual Hosting selects only which vService to go to; inside the vService, Conditional and Default Backend Services determine which Backend Service to go to.

Catching Unmatched Requests

Need	What is done
All subdomains of a domain should go to the same site	*.example.com is added to the list of the vService
The main domain should also arrive	example.com is also added to the list
Unknown names should be handled in a single place	The domains are gathered in a single vService with a wildcard; inside, they are separated with Conditional Backend Services (Content Switching) and Default Backend Services

Common Misconceptions

• "An unmatched request goes to the first vService." There is no default target; the request reaches no vService.
• "An HTTPS test with the IP address opens the site." In a request made with the IP, SNI is not sent and the connection is closed; the test is done with the domain (curl --resolve).
• "The error page of the vService appears instead of 503." Since matching fails before a vService is selected, no setting of any vService (including Show Content for Traffic Manager Errors) is applied to the request.

How it is done in the documentation

• HTTP vService · Virtual Hosting
• HTTP vService · Default Backend Services

Related questions

• What is Virtual Hosting, and how does it work?
• Can I do Virtual Hosting with a wildcard domain (*.example.com)?
• Where does traffic go if no condition matches?