When using the cXML punch-out, the system punching out, such as Ariba, Oracle or other cXML based punch-out systems, must punch-out to a specific url, not to your home page.
The specific url is as follows:
https://yoursite.com/punchout/receivesetuprequest.aspx where "yoursite.com' is replaced with your actual site domain.

To approve or release an order for production the punch-out system should send the po to:
https://yoursite.com/punchout/AribaOrderRelease.aspx where "yoursite.com' is replaced with your actual site domain.