The old provider was doing weird stuff with DNS that I wasn’t able to debug well. However, apparently, the old provider did MSS clamping on their side. Therefore, it is now required that I do this on my side.