How to Resolve IDFix TopLevelDomain Errors for Internal Proxy Addresses
Question details
The user needs to resolve TopLevelDomain errors reported by the IDFix tool before synchronizing with Azure AD Connect.
- Product
- Active Directory / Microsoft Exchange
- Device & OS
- Windows Server
- Scenario
- Preparing on-premises Active Directory environment for Azure AD Connect synchronization.
- Observed behavior
- IDFix reports a TopLevelDomain error because Exchange proxyAddresses contain non-routable internal domains (e.g., domain.local).
Ensure you have the Active Directory PowerShell module installed and administrative privileges to modify mail-enabled objects. Always export your current proxy addresses to a CSV backup before performing bulk attribute modifications.
Use Active Directory PowerShell to Remove Non-Routable Domains
Identify and remove internal, non-routable proxy addresses from mail-enabled objects using PowerShell commands.
TopLevelDomain errors occur because Azure AD does not accept non-routable suffixes like '.local' or '.lan'. To ensure a successful Azure AD Connect synchronization, you must clean up the proxyAddresses attribute for all synchronized objects.
Right-click the Windows PowerShell icon and select 'Run as administrator' to ensure you have the necessary permissions.
Type 'Import-Module ActiveDirectory' and press Enter to load the necessary cmdlets for querying and modifying AD objects.
Use the Get-ADUser or Get-ADObject cmdlet to find objects where the proxyAddresses attribute contains your internal domain (e.g., '*@mydomain.local').
Pipe the results of your query to 'Export-Csv' to generate a file containing the affected users. Open this CSV file to review the non-routable aliases before making any changes.
Write a foreach loop to process the exported objects, using the Set-ADUser cmdlet with the -Remove parameter targeting the specific non-routable addresses in proxyAddresses.
Manage IT Export Data and Reports with WPS Office
While resolving IDFix errors requires working directly within your Microsoft server environment, IT administrators frequently need to review exported CSV reports, document migration procedures, and analyze PowerShell logs. WPS Office provides a free, lightweight, and highly compatible alternative to Microsoft Office for all your administrative documentation needs.
- 1. Download and Install: Get the free WPS Office suite from the official website and install it on your workstation.
- 2. Open Exported CSVs: Use WPS Spreadsheet to seamlessly open, filter, and review your PowerShell Active Directory proxy address exports.
- 3. Document Procedures: Use WPS Writer to create comprehensive documentation for your Azure AD Connect migration steps and cleanup processes.
Frequently Asked Questions
What causes the TopLevelDomain error in IDFix?
This error is triggered when an object's UPN, proxyAddresses, or mail attribute contains a domain suffix that cannot be routed on the public internet, such as .local, .lan, or .corp.
Can I synchronize objects with a .local domain to Azure AD?
No. Azure AD requires a publicly routable domain. You must add a verified, routable domain to your Microsoft 365 tenant and update your on-premises user attributes to match before syncing.
How do I safely test my proxy address cleanup script?
Export the targeted users to a CSV file first, manually verify the non-routable aliases, and then apply your PowerShell removal script to a small organizational unit (OU) containing a few test accounts before broad deployment.
