The two types that matter
- Authoritative (the default): this tenant OWNS the namespace. A recipient not found in the directory = 550 5.1.10, end of story. Correct for normal domains.
- InternalRelay: unknown recipients are NOT bounced — they route onward via a matching outbound connector. The shared-namespace tool: migrations where some users live elsewhere, split routing with a sister company, dual-delivery experiments.
The classic incidents at this boundary:
| Incident | Mechanism |
|---|---|
| Mid-migration users bounce (5.1.10) as they move | Domain authoritative while mailboxes still split — should be InternalRelay + connector to the other side until DONE |
| Mail loops with the other system | InternalRelay both sides pointing at each other with no directory truth — loops until hop count dies (5.4.14) |
| Random externals bounce after 'cleanup' | Someone flipped relay→authoritative while forgotten recipients still lived off-tenant |
| New subdomain won't receive | Never added as accepted domain — Exchange rejects what it doesn't own or relay |
Operational rules
Domains arrive from the M365 domain registration (verified in Entra), then get their TYPE here; subdomains need their own entries (or the match-subdomains flag, used sparingly); and the type is part of MIGRATION design, not a static fact — plan the flip dates into cutover runbooks explicitly, because the type change is one cmdlet with estate-wide routing consequences.
What to watch (proofs)
- The register: Get-AcceptedDomain | ft Name, DomainName, DomainType — in the serv365 nightly scan; a DomainType flip is precisely the kind of one-line change with outage-grade blast radius that drift alerting exists for.
- The unknown-recipient behaviour, demonstrated: send to nonexistent@yourdomain — 5.1.10 (authoritative) vs onward routing (relay); one test per domain type per migration phase.
- Loop insurance: 5.4.14 alerts (NDR concept) — the relay-pair loop's signature.
- Subdomain coverage: mail-enabled subdomains in use (trace data) vs the accepted-domain list — senders love inventing subdomains.