Plan and manage the mail transport architecture
Domain 2 - Plan and manage the mail transport architecture
This domain tests how messages enter, route through, and leave Exchange Online and hybrid Exchange. Know connector selection, MX and smart hosts, TLS, accepted domains, routing boundaries, and the transport pipeline.
Core rules
- Inbound mail follows MX to the tenant's protection service, then Exchange Online. An inbound connector is needed for a partner or hygiene service that sends directly to your tenant; scope it by IP address or certificate and restrict permissions.
- Outbound mail uses a send connector. In a hybrid deployment without centralized transport, Exchange Online sends directly to the internet. With centralized mail transport enabled in the Hybrid Configuration Wizard, outbound mail routes through on-premises Exchange.
- Connector selection considers source/destination, address spaces, cost, and TLS settings. Certificate validation and the remote domain's TLS settings affect delivery.
- The transport pipeline includes categorization, routing, queueing, and delivery. Message trace shows the path and the transport rule or connector that acted on a message.
Worked example
An organization has Exchange 2016 on-premises and Exchange Online, and requires all outbound internet mail to leave through an on-premises hygiene appliance. Run the Hybrid Configuration Wizard and enable centralized mail transport. This creates a send connector in Exchange Online scoped to the on-premises smart host and a receive connector on-premises that trusts the Exchange Online source. Publish the appliance as the outbound smart host. Reasoning: without centralized transport, Exchange Online bypasses the appliance; the HCW option changes the outbound path, not the inbound MX record. Test with message trace from a cloud mailbox to an external address.
Traps
- A send connector with a more specific address space wins over a broader one, regardless of cost.
- An inbound connector does not change MX; DNS must point to the correct entry point.
- TLS failures often appear as connector or certificate errors, not as anti-spam rejections.