I have a really complex issue which I am struggling to even get my head around at the moment, but I will try to explain.
I am running SBS 2011 but this issue relates specifically to Exchange 2010. I am hosting multiple domain; lets call them domain1.local, domain1.com, domain2.net
I've set up 3 UPNs, I 've set up 3 accepted domains and I've set up 3 email policies.
I've set up 2 external MX records (i didn't bother with domain1.local) - The MX records for both domains points to the same exchange server (remote.domain1.com)
Mail routes exactly as I would expect, so all is fine here.
My issue relates to clients. I have 2 users. user1@domain1.com and user2@domain2.net
user1@domain1.com email address is abc@domain1.com
user2@domain2.net email address is abc@domain2.net
The key point here is the prefix for each user is the same.
In testing, both accounts have the same password (which can occur in real world situation). When user2@domain2.net sets up their account on a client (let's use iPhone exchange client as an example), it asks for the users email address (NOT their AD creds) and when connecting to exchange the domain suffix is dropped leaving just a prefix name (which in this case is essentially duplicated).
User2 ends up with access to user1 mailbox.
I think I need two things in order to make this work properly.
1) exchange to require a fully qualified name to login (not just a prefix)
2) exchange to support logins using fully qualified email address (NOT AD credentials) due to the way in which some client setup mail accounts.
I hope someone can understand my issue and possibly offer some advice.
Paul