diff --git a/coreapi/bellesip_sal/sal_address_impl.c b/coreapi/bellesip_sal/sal_address_impl.c
index b6ed5b77e..505ee95e3 100644
--- a/coreapi/bellesip_sal/sal_address_impl.c
+++ b/coreapi/bellesip_sal/sal_address_impl.c
@@ -208,6 +208,11 @@ void sal_address_set_uri_params(SalAddress *addr, const char *params){
 	belle_sip_parameters_set(parameters,params);
 }
 
+bool_t sal_address_has_uri_param(SalAddress *addr, const char *name){
+	belle_sip_parameters_t* parameters = BELLE_SIP_PARAMETERS(belle_sip_header_address_get_uri(BELLE_SIP_HEADER_ADDRESS(addr)));
+	return belle_sip_parameters_has_parameter(parameters, name);
+}
+
 void sal_address_set_header(SalAddress *addr, const char *header_name, const char *header_value){
 	belle_sip_uri_set_header(belle_sip_header_address_get_uri(BELLE_SIP_HEADER_ADDRESS(addr)),header_name, header_value);
 }
diff --git a/coreapi/quality_reporting.c b/coreapi/quality_reporting.c
index 5f01ab99b..ea4ba3f6e 100644
--- a/coreapi/quality_reporting.c
+++ b/coreapi/quality_reporting.c
@@ -271,8 +271,7 @@ static int send_report(LinphoneCall* call, reporting_session_report_t * report,
 	int ret = 0;
 	LinphoneEvent *lev;
 	LinphoneAddress *request_uri;
-	char * domain;
-	const char* route;
+	const char* collector_uri;
 
 	/*if we are on a low bandwidth network, do not send reports to not overload it*/
 	if (linphone_call_params_low_bandwidth_enabled(linphone_call_get_current_params(call))){
@@ -353,14 +352,21 @@ static int send_report(LinphoneCall* call, reporting_session_report_t * report,
 	}
 
 
-	route = linphone_proxy_config_get_quality_reporting_collector(call->dest_proxy);
-	domain = ms_strdup_printf("sip:%s", linphone_proxy_config_get_domain(call->dest_proxy));
-	request_uri = linphone_address_new(route ? route : domain);
-	ms_free(domain);
+	collector_uri = linphone_proxy_config_get_quality_reporting_collector(call->dest_proxy);
+	if (!collector_uri){
+		collector_uri = ms_strdup_printf("sip:%s", linphone_proxy_config_get_domain(call->dest_proxy));
+	}
+	request_uri = linphone_address_new(collector_uri);
 	lev=linphone_core_create_publish(call->core, request_uri, "vq-rtcpxr", expires);
-	if (route) {
-		ms_message("Publishing report with custom route %s", route);
-		sal_op_set_route(lev->op, route);
+	/* Special exception for quality report PUBLISH: if the collector_uri has any transport related parameters
+	 * (port, transport, maddr), then it is sent directly.
+	 * Otherwise it is routed as any LinphoneEvent publish, following proxy config policy.
+	 **/
+	if (sal_address_has_uri_param((SalAddress*)request_uri, "transport") || 
+		sal_address_has_uri_param((SalAddress*)request_uri, "maddr") ||
+		linphone_address_get_port(request_uri) != 0) {
+		ms_message("Publishing report with custom route %s", collector_uri);
+		sal_op_set_route(lev->op, collector_uri);
 	}
 
 	if (linphone_event_send_publish(lev, content) != 0){
diff --git a/include/sal/sal.h b/include/sal/sal.h
index acfc5d3b5..07483faa0 100644
--- a/include/sal/sal.h
+++ b/include/sal/sal.h
@@ -126,6 +126,7 @@ void sal_address_set_transport_name(SalAddress* addr,const char* transport);
 void sal_address_set_method_param(SalAddress *addr, const char *method);
 void sal_address_set_params(SalAddress *addr, const char *params);
 void sal_address_set_uri_params(SalAddress *addr, const char *params);
+bool_t sal_address_has_uri_param(SalAddress *addr, const char *name);
 bool_t sal_address_is_ipv6(const SalAddress *addr);
 bool_t sal_address_is_sip(const SalAddress *addr);
 void sal_address_set_password(SalAddress *addr, const char *passwd);
diff --git a/linphone.spec.in b/linphone.spec.in
index fa5541a0a..a92ec864e 100644
--- a/linphone.spec.in
+++ b/linphone.spec.in
@@ -100,6 +100,7 @@ rm -rf $RPM_BUILD_ROOT
 %{_bindir}/lpc2xml_test
 %{_bindir}/xml2lpc_test
 %{_bindir}/lp-gen-wrappers
+%{_bindir}/lp-sendmsg
 %{_includedir}/linphone
 %{_libdir}/*.a
 %{_libdir}/*.la
diff --git a/mediastreamer2 b/mediastreamer2
index 085f64d41..f6fb1dc8f 160000
--- a/mediastreamer2
+++ b/mediastreamer2
@@ -1 +1 @@
-Subproject commit 085f64d41e8c6643294f6c9cb9f256ca52e9c019
+Subproject commit f6fb1dc8f24aaf2f1064bb756cdd0144a2c452da
diff --git a/tester/call_tester.c b/tester/call_tester.c
index d25404c14..84badb920 100644
--- a/tester/call_tester.c
+++ b/tester/call_tester.c
@@ -547,14 +547,14 @@ static void call_outbound_with_multiple_proxy(void) {
 
 	// set first LPC to unreacheable proxy addr
 	linphone_proxy_config_edit(lpc);
-	linphone_proxy_config_set_server_addr(lpc,"12.13.14.15:5223;transport=udp");
-	linphone_proxy_config_set_route(lpc, "12.13.14.15:5223;transport=udp;lr");
+	linphone_proxy_config_set_server_addr(lpc,"sip:linphone.org:9016;transport=udp");
+	linphone_proxy_config_set_route(lpc, "sip:linphone.org:9016;transport=udp;lr");
 	linphone_proxy_config_done(lpc);
 
-	BC_ASSERT_TRUE(wait_for_until(pauline->lc, NULL, &pauline->stat.number_of_LinphoneRegistrationOk, 1, 2000));
+	BC_ASSERT_TRUE(wait_for_until(pauline->lc, NULL, &pauline->stat.number_of_LinphoneRegistrationOk, 1, 10000));
 
 	BC_ASSERT_TRUE(wait_for_until(marie->lc, NULL, &marie->stat.number_of_LinphoneRegistrationProgress, 2, 200));
-	BC_ASSERT_TRUE(wait_for_until(marie->lc, NULL, &marie->stat.number_of_LinphoneRegistrationOk, 1, 2000));
+	BC_ASSERT_TRUE(wait_for_until(marie->lc, NULL, &marie->stat.number_of_LinphoneRegistrationOk, 1, 10000));
 
 	// calling marie should go through the second proxy config
 	BC_ASSERT_TRUE(call(marie, pauline));