Django doesn't blindly trust the Host header. It validates it according to your `ALLOWED_HOSTS` setting.

https://github.com/django/django/blob/master/django/http/request.py#L61-L89