Found the answer to this. In retrospect, my first clue should have been that the UAC in this situation does not include a branch parameter in the Via header it inserts at all, let alone one with a branch ID starting with "z9hG4bK", the magic cookie indicating 3261 compatibility. RFC 2543, the obsolete first-generation spec, dictates that the behaviour I described is actually exactly how the UA should behave in this situation, as spelled out in Section 6.29 ("Record-Route"): Unless this would cause a loop, any client MUST send any subsequent requests for this call leg to the first Request-URI in the Route request header field and remove that entry. In other words, consuming the first URI in the Route set and using it as the target for sequential requests is normal in 2543-land. 2543 UAs do not understand the ;lr parameter in the Record-Route header, and hence don't do 3261-style loose routing. -- Alex Balashov - Principal Evariste Systems LLC 1170 Peachtree Street 12th Floor, Suite 1200 Atlanta, GA 30309 Tel: +1-678-954-0670 Fax: +1-404-961-1892 Web: http://www.evaristesys.com/