diff --git a/CHANGES b/CHANGES
index 01e89b2ed..c917c4f07 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1092,4 +1092,5 @@
 * Do not set the HTTPS agent when using HTTP with minio backup backend
 * Fix regression where a new domain config could not be set in the UI
 * New mail container release that fixes email sending with SOGo
+* Show 404 page for unknown domains
 
diff --git a/setup/start/nginx/appconfig.ejs b/setup/start/nginx/appconfig.ejs
index 85d4c787a..5a4d4d97e 100644
--- a/setup/start/nginx/appconfig.ejs
+++ b/setup/start/nginx/appconfig.ejs
@@ -14,7 +14,7 @@ server {
 <% if (vhost) { -%>
     server_name  <%= vhost %>;
 <% } else { -%>
-    # IP based access. TODO: match the IPv6 address
+    # IP based access from collectd or initial cloudron setup. TODO: match the IPv6 address
     server_name  "~^\d+\.\d+\.\d+\.\d+$";
 
     # collectd
@@ -24,12 +24,6 @@ server {
         allow 127.0.0.1;
         deny all;
     }
-
-    # acme challenges
-    location /.well-known/acme-challenge/ {
-        default_type text/plain;
-        alias /home/yellowtent/platformdata/acme/;
-    }
 <% } -%>
 
     location / {
diff --git a/setup/start/nginx/nginx.conf b/setup/start/nginx/nginx.conf
index 4511e5318..d3adaf3fc 100644
--- a/setup/start/nginx/nginx.conf
+++ b/setup/start/nginx/nginx.conf
@@ -43,6 +43,12 @@ http {
         listen      [::]:80 default_server;
         server_name does_not_match_anything;
 
+        # acme challenges
+        location /.well-known/acme-challenge/ {
+            default_type text/plain;
+            alias /home/yellowtent/platformdata/acme/;
+        }
+
         location / {
             return 404;
         }