have you verified that the authurl matches the mailmode?
zmprov gs sub.domain1.com | grep MailMode
zmprov gs sub.domain1.com | grep AuthURL
it sounds like you're using SSL so the mailmode must be either mixed or https. make sure the authurl starts with https |