Outlook Web App > For Exchange Online Administrators > Shared Address Space >

Shared Address Space with On-Premises Relay

Applies to: Live@edu

Topic last modified: 2011-07-06

If you are deploying cloud-based mailboxes to supplement an existing on-premises messaging system, you may want to have a shared address space. A shared address space is when two different messaging systems share the same domain suffix.

There are two ways to configure a shared address space. This topic describes the on-premises relay configuration, in which all email sent to recipients in the shared address space by a sender on the Internet is first delivered to the on-premises messaging system. The on-premises messaging system is responsible for forwarding email addressed to recipients in the cloud-based email service.

You may also want to consider Shared Address Space with Cloud Relay. With cloud relay, all email sent to recipients in the shared address space by a sender on the Internet is first delivered to the cloud-based email service, and the cloud-based email service is responsible for forwarding email addressed to recipients in the on-premises messaging system using mail users.

An example of on-premises relay

Contoso University uses the @contoso.edu address space for all faculty and staff email addresses in an on-premises messaging system. Contoso University plans on giving all students cloud-based mailboxes. However, Contoso University wants all faculty, staff and students to use the @contoso.edu domain suffix for all email addresses. All email messages must leave the organisation with an @contoso.edu From: address, whether the sender is in the on-premises messaging system or in the cloud-based email service. All incoming messages with an @contoso.edu email address should be correctly delivered whether the recipient is in the on-premises messaging system or in the cloud-based email service. To achieve this goal, Contoso University has to implement a shared address space.

The following diagram illustrates the deployment of a shared address space for Contoso University.

Note the following key points:

  • All email sent to any @contoso.edu recipient by a sender on the Internet is first delivered to the on-premises messaging system.
  • The on-premises messaging system is responsible for forwarding email addressed to students in the cloud-based email service.
Shared address space

Required components for a shared address space

To make the shared address space work, you need the following components:

  • Multiple domains
  • Multiple email addresses

Multiple domains

Ironically, to configure a single shared address space, you need to configure multiple domains. The following domains are required for a shared address space:

  • The domain for the shared address space itself   In this example, the shared domain is @contoso.edu. This is also the domain that is used for the on-premises messaging system.
  • A specific domain for mailboxes in the cloud-based email service   In this example, the cloud-based domain is @live.contoso.edu.

The cloud-based domain must be different from the on-premises domain so email is correctly routed between the on-premises messaging system and the cloud-based email service. Senders and recipients that are outside the organisation don't care about the cloud-based domain, but it is a vital part of making the shared address space work correctly.

Multiple email addresses

A key ingredient to a shared address space is correctly configuring the email addresses on mailboxes in the on-premises messaging system and in Outlook Live.

Here's how the email addresses must be configured on all mailboxes:

  • The primary address   The primary address is used as the From: address for all messages sent from the mailbox. There can be only one value for the primary address. In this example, everyone's primary address is in the shared address space @contoso.edu.
  • Proxy addresses   Proxy addresses are additional addresses for a mailbox. Proxy addresses are also known as secondary email addresses. The mailbox can receive email sent to any of its proxy addresses. The primary address is always listed as a proxy address.

Here are the correct values for the primary address and proxy addresses for on-premises mailboxes and Outlook Live mailboxes.

  On-premises mailboxes Outlook Live mailboxes

Primary address

<user>@contoso.edu

<user>@contoso.edu

Proxy addresses

<user>@contoso.edu

  • <user>@contoso.edu
  • <user>@live.contoso.edu

How does email delivery work in the shared address space?

When you share an address space between an on-premises messaging system and the cloud-based email service, one of the messaging systems must be configured as authoritative for the shared address space. When the messaging system is designated as authoritative for the @contoso.edu domain, all unresolved recipients generate a non-delivery report (NDR). This configuration prevents email for nonexistent recipients from bouncing back and forth indefinitely between the on-premises messaging system and the cloud-based email service.

You configure the shared address space @contoso.edu in the cloud-based email service as a non-authoritative address space. If the @contoso.edu recipient isn't found in the cloud-based email service shared address book, the message is forwarded to the on-premises messaging system for processing. If the recipient doesn't exist, the on-premises messaging system is responsible for generating the NDR.

If @contoso.edu is configured as the authoritative name space for the on-premises messaging system, how does the on-premises messaging system know to forward messages for valid cloud-based recipients to the cloud-based email service without generating an NDR? The on-premises messaging system must be configured with a forwarding solution that converts the @contoso.edu recipients to @live.contoso.edu recipients. For example:

  • You create mail users or mail contacts in the on-premises address book for all cloud-based recipients.
  • You use address rewriting from @contoso.edu to @live.contoso.edu for all unresolved @contoso.edu recipients.

Other forwarding solutions may also be available depending on the nature of the on-premises messaging system. Regardless of the forwarding solution that you use, make sure that email for nonexistent recipients is handled correctly for both the on-premises messaging system and the cloud-based email service.

Examples of how email is delivered

As noted earlier, the on-premises messaging system is configured to accept all incoming email from the Internet for the shared address space. In the Contoso University example, all email for the @contoso.edu domain is delivered to the on-premises messaging system. You accomplish this by configuring the MX record for the contoso.edu domain in an Internet-facing DNS server to point to the on-premises messaging system.

After the email arrives, the on-premises messaging system is responsible for correctly determining if the recipient has a mailbox in the on-premises messaging system or in the cloud-based email service, and then delivering the message or forwarding the message as appropriate.

Here are two email routing scenarios in a shared address space:

  • Email sent to students in the cloud-based email service   The messages could come from external senders on the Internet, or from faculty and staff in the on-premises messaging system. The on-premises messaging system is configured to forward email for students to the cloud-based email service. The required configuration depends heavily on the nature of the on-premises messaging system. For details, see Configure a Shared Address Space with On-Premises Relay.
  • Email sent from students in the cloud-based email service to faculty and staff in the on-premises messaging system   The shared address space @contoso.edu is configured as an internal relay domain in the cloud-based email service. When the faculty or staff recipient isn't found in the cloud-based shared address book, the message is routed to the Internet and the contoso.edu domain points to the on-premises messaging system, so the message is delivered successfully.

Internal email between recipients in the on-premises messaging system or between students in the cloud-based email service is straight-forward. In both cases, the recipients are in their respective address books, so the message is delivered locally.

Likewise, outgoing email to recipients outside the organisation operates as expected. The on-premises messaging system uses its existing path to the Internet to deliver email messages to the Internet for recipients outside the organisation, and the cloud-based email service delivers messages directly to the Internet.

Things to consider

In the shared address space scenario, when incoming email is first delivered to the on-premises messaging system before being forwarded to the cloud-based email service, the on-premises messaging system becomes a single point of failure. The cloud-based domain can be functioning normally, but because something is wrong with the on-premises messaging system, email can't be delivered to cloud-based recipients.

Also, the on-premises messaging system is responsible for protecting messages that are forwarded to the cloud-based email service from spam and viruses. Failure to do so may cause the email coming from the on-premises messaging system to be blocked or severely throttled by Forefront Online Protection for Exchange.