Learn › Exchange Online › 2 · Mail flow fundamentals

Mail flow in hybrid

Hybrid mail flow is two organisations pretending to be one, glued by connectors and headers. It works beautifully until someone routes creatively — then you get loops, lost attribution, or internet detours for internal mail.

The glue, named

The HCW builds a connector PAIR: EXO's OnPremises-type inbound connector (trusting your Exchange servers' certificate) and an on-prem send connector to EXO — over which mail keeps its INTERNAL status: headers preserved, anti-spam softened appropriately, recipients resolved either side. Cross-premises mail should look, to users and compliance, like one org's mail. When that's true, hybrid flow is boring — the goal state.

The design decision: where does internet mail enter and exit?

  • Decentralised (default, sane): each side talks to the internet for its own mailboxes. MX usually at EXO (or the filter in front).
  • Centralized Mail Transport: ALL internet mail routes via on-prem (compliance appliances, DLP boxes, regulatory habits). Every cloud mailbox's mail hairpins through the datacentre — latency, dependency and the classic 'why is cloud mail slow' answer. Choose it only for a real requirement, and write its exit plan the same day.

The recurring hybrid-flow incidents

Incident Mechanism
The loop (5.4.14) Recipient exists NOWHERE; authoritative/relay settings bounce it back and forth across the pair
Internal mail lands external/filtered The connector pair's trust broken (cert renewed on-prem, connector not updated) — mail still flows but as INTERNET mail: banners, SPF checks, quarantines
One-way breakage Firewall/cert affects one direction; each direction is its own connector+path — test both, always
Centralized transport bypassed An EXO-side change (new domain, new connector) routing around the on-prem stack compliance thinks it owns

The cert-renewal one deserves fear: the TLS certificate on-prem is the connector trust anchor — its renewal is a HYBRID event, not a server event (Teams DR's certificate lesson, third appearance).

What to watch (proofs)

  • Trust health: an internal cross-premises message's headers — X-MS-Exchange-Organization-AuthAs: Internal is the glue working; 'Anonymous' on internal mail = the pair is broken, act now.
  • The pair's config: hybrid connectors in the scan (inbound connector cert subject vs the on-prem cert's actual subject — diff on renewal).
  • Both directions, tested on schedule: canary mails each way with trace verification — hybrid's version of the SBA failover drill.
  • Loop and 5.1.10 trends on shared domains — the mid-migration routing-truth decay signal (accepted-domains concept).

The wire

  • Cross-premises: connector pair with cert trust; AuthAs Internal preserved in headers
  • CMT: cloud mailbox internet mail hairpins via on-prem — a chosen dependency

PowerShell for this concept

  • Get-InboundConnector View the settings for an Inbound connector in your cloud-based organization.
  • Get-OutboundConnector View the configuration information for an Outbound connector in your cloud-based organization.
  • Get-AcceptedDomain View the configuration information for the accepted domains in your organization.

Discussion

No messages yet — start the thread.

Sign in with your email to join the discussion — we send a one-time link, no password.