Mail-Flow Between Online and On-Prem in Hybrid Exchange

Dieter Tontsch (GMail) 972 Reputation points
2022-04-14T10:17:25.18+00:00

Hello.

I have a problem with the correct understanding regarding Email-Routing between Exchange Online and on-prem according to where the Mailbox within a hybrid Setup is located, online or on-prem.
Therefor I have a few questions:

  1. What is the correct setup re. Accepted Domains, should both Exchange have the domains configured as Authoritative, or should one be configured as Internal Relay? From what I understand here it should be Authoritative (https://blog.expta.com/2019/07/authoritative-vs-internal-relay-domains.html), and I am not talking about the "implicit" domains like tenant.onmicrosoft.com and tenant.mail.onmicrosoft.com, these two are only configured in Exchange Online as Authoritative. The mail flow on-prem --> online is clear to me, that happens based on the fact whether there is a targetAddress (remote routing address @tenant .mail.onmicrosoft.com) attribute present or not.
  2. How is routing performed online --> on-prem (specifically this direction), since there the targetAddress attribute does not exist, we are synching our users via AzureADSync on-prem --> azure. I fell like the primary email value, also seen with uppercase SMTP: is kind of a replacement for targetAddress in EXO. And somehow, probably because of the hybid setup EXO knows that for mydomain.com either an online mailbox exists,or if not, the email is forwarded to the on-prem server, right? For now, since we just started migrating mailboxes for most of the domains, at least the productive ones, there is NO MX record for EXO, but only for on-prem. This means, emails fro outside always come to the on-prem server, which, according to targetAddress eventually forwards the mail to EXO, else it delivers it to a local mailbox. And as I said, the forwarding on-prem --> online is something I understand, where I am not sure is the online --> on-prem direction.
  3. I have an user/mailbox on-prem which has a primary mail address like mydomain.biz. and mydomain.biz, yet as the only domain, only has an MX-record pointing to EXO. As long this user, who is synced to AzureAD keeps this primary address mydomain.biz and mydomain.biz is configured as authoritative, emails, no mater whether from internet or EXO mailbox users, are rejected because that mailbox does not exist in EXO. Why is this not forwarded to on-prem? If I change the primary email address to something mydomain.com, which yt has no MX-record pointing to EKO but only to on-prem, the mail, even if still sent to mydomain.biz is forwarded from EXO to on-prem. This is what bothers me and I am trying to understand the logic behind this.
    Even if I configure mydomain.biz as internal relay address in EXO and add a secondary MX-record pointing to the on-prem server, where the mail should be forwarded in order to be delivered, the delivery still fails. The only way to make this work for this mydomain.biz alias if if I set the primary address to that user to mydomain.com, keeping mydomain.biz as an alias only.

My main concern is, based on what does EXO decide whether it gives an email for an user which is in AzureAD, but has no online mailbox (is not yet migrated), to give it another try and forward the email to the peer on-prem server, or to reject it? Why is the domain for the primary user mail-address so decisive, especially because both domains mydomain.com and mydoman.biz are configured the same way, authoritative on both Exchange server.

And what is a good approach re. MX records, when should I switch from on-prem MX to online MX or keep both with different priority for while etc...? How does this affect the mail flow, not from the perspective of the mail servers in internet, these are fine, but fro the hybrid mail flow between on-prem <--> online.

See also my initial post from where this all started here https://learn.microsoft.com/en-us/answers/questions/811088/user-was-not-found-in-domaincom-if-not-synched-fro.html

kind regards,
Dieter

Exchange Online
Exchange Online
A Microsoft email and calendaring hosted service.
6,190 questions
Exchange | Exchange Server | Management
Exchange | Hybrid management
0 comments No comments
{count} votes

2 answers

Sort by: Most helpful
  1. Andy David - MVP 157.8K Reputation points MVP Volunteer Moderator
    2022-04-14T11:47:09.087+00:00

    If you have any objects that arent synced to Azure and exist on-prem only, then the accepted domain in ExO must be set to Internal Relay and have a connector to On-prem with that address space

    https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains

    193097-image.png

    As far as the MX record, I always recommend changing it to Exchange Online as soon as possible.


  2. Dieter Tontsch (GMail) 972 Reputation points
    2022-04-19T09:34:16.043+00:00

    I got the solution from @ KyleXu-MSFT here https://learn.microsoft.com/en-us/answers/questions/811088/user-was-not-found-in-domaincom-if-not-synched-fro.html

    I need to have all the domains which should be routed from O365 to On-Prem to my HCW-created connector O365 --> on-prem. Before I only had my xxxag.de domain specified there, and therefor xxxag.biz domains (as primary Email-Address) did not route.

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.