/.well-known/caldav answered 307 to https://<domain>/dav/cal, and that path was portal's catch-all - so a client that did the discovery correctly followed it into an HTML page. Stalwart builds the Location from the forwarded host rather than the Host this route rewrites, so rather than fight that, /dav/* is served here too and the client stays on one origin for the whole exchange. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015GeH3y8fwTaTudaD88P57o