The species, mail-mechanically
| Classic DL | M365 Group | Dynamic DL | |
|---|---|---|---|
| Membership | Static list | Static list + owners | A recipient filter, evaluated at SEND time |
| The mail | Expands to members | Expands + lands in the group mailbox (the archive/compliance copy) | Expands per evaluation |
| Extras | Nesting, delivery management, moderation | Site, Teams-ability, the whole container world | Zero extras — it's routing logic |
| Governance home | Exchange | Entra/Groups platform (Teams curriculum's lifecycle machinery) | Exchange |
The behaviours that generate tickets
- Dynamic DL evaluation is at send time and lagged: membership reflects directory attributes as the SYSTEM currently sees them — a rehired user or fresh attribute takes its propagation time to start receiving. 'Preview members' (Get-DynamicDistributionGroupMember) shows the query's CURRENT answer — the proof tool for 'why didn't/did Dave get it'.
- Delivery management (sender restrictions) produces the 5.7.13x NDR family (codes concept) — internal-senders-only is the default posture people forget they set.
- Nesting hides members: expansion is recursive; moderation and restrictions evaluate per-hop — deep nests make delivery paths nobody can reason about. Keep nesting shallow and documented.
- Reply-all storms: big DLs + no restrictions = the classic. Mitigations that work: sender restrictions on large lists, moderation for announce-lists, and (for the giants) Exchange's reply-all storm protection doing its automatic dampening.
- DL→M365 Group upgrades: the pushed migration path — gains a mailbox/compliance story, changes the object's platform and governance owner; eligibility excludes nested/moderated exotics. Upgrade deliberately, not via the nag button.
What to watch (proofs)
- The census by species: recipients grouped by type (recipient-model concept's pipe) — plus size outliers: every 1,000+ member DL without sender restrictions is a storm pre-incident.
- Dynamic queries audited: each DDL's RecipientFilter + a preview count vs expectation (both via cmdlets — the query that quietly matches 40,000 is the finding).
- Delivery-management map: restricted lists + their allowed senders — the 5.7.13x pre-emption table for the service desk.
- Storm telemetry: reply-all storm protection events (message trace patterns/reports) — each firing is a governance case study with names attached.