The sitemap opens on the correct website, but its entries point to another domain. First establish whether this is intentional. A centrally managed sitemap for verified sites is different from an accidentally exported preview hostname.
Look beyond the file’s location
Fictional example: https://example.com/sitemap.xml contains only addresses on preview.example.com, although the pages now live on the main domain. An old base URL in the build or CMS is a plausible cause.
Compare the configured public host with several loc values. Check the same pages’ canonical URLs and internal links. Different domains across these signals create an inconsistent setup.
Google documents cross-site sitemap submission with verified control of the relevant sites. Record which websites are involved and how that relationship is confirmed. A different hostname is not automatically correct just because the URL responds.
If the preview host was included by mistake, correct the source configuration and regenerate the sitemap. Inspect the publicly delivered file afterwards, including any cached version. A correct local export does not prove that the public file has changed.
If the preview site contains confidential material, review access protection separately. Removing its URLs from the sitemap does not protect the content.
Related check: Remove redirects from a sitemap.
When different systems assume different public hosts, the Technology and stack review offers a starting point for clarifying technical responsibilities.