diff --git a/max/routes/__init__.py b/max/routes/__init__.py
index c241002..277819c 100644
--- a/max/routes/__init__.py
+++ b/max/routes/__init__.py
@@ -1,5 +1,6 @@
 from max.auth import no_authentication_required
 from max.csrf import no_csrf
+from max.exceptions import NotFound
 
 from .alias.create import AliasCreate
 from .alias.delete import AliasDelete
@@ -21,6 +22,10 @@ from .user.toggle_can_use_different_alias_domain import (
 from .user.toggle_enabled import UserToggleEnabled
 
 
+def not_found(**kwargs):
+    raise NotFound()
+
+
 def init_routes(app):
     app.add_url_rule("/", "own-user-detail", UserDetail.as_view())
     app.add_url_rule("/list", "user-list", UserList.as_view())
@@ -78,3 +83,7 @@ def init_routes(app):
         "favicon",
         no_csrf(no_authentication_required(Favicon.as_view())),
     )
+
+    # Matches only URLs without another rule. They pass the middlewares like any
+    # other view, so the ExceptionMiddleware renders the not found page.
+    app.add_url_rule("/<path:path>", "not-found", not_found)