I think when I tested this and was getting the 522 error, the worker was listening on domainA.com in CF, and I was trying to proxy traffic by using a header 'Host: domainA.com' and targetting 'site1.domainB.com' and 'site2.domainB.com' .. I think that was the case when I met the error and read somewhere that the proxy sub-request should be on the same domain like the workers zone (otherwise the host header wouldn't be rewritten?) .. something like that, I need to test it again to remember the exact case. I was just wondering if I will meet the same problem with CF for SaaS but given that I don't remember the error case 100% I probably need to work on that first before I ask for help. Thank you for your reply though, much appreciated.