how does exchange online choose an inbound connector?

hi all,

i have a hard time understanding how exactly exchange online determines which inbound connector to use. as i understand it, a match of the sending domain should lead to the use of the matching connector. if there is no match, it uses a connector configured for "any" ("*") or the (hidden) default inbound connector. i would like to use enhanced filtering / skip listing for all sender domains, while at the same time being able to disable this feature for select domains. so i configured one connector for "any" sender and enabled enhanced filtering on that one. i then configured another connector for specific sender domains and did not enable enhanced filtering on that one.

since my setup was not working as expected, i did some testing and dug into some message traces. i noticed some strange behavior regarding inbound mail traffic and connector selection, and i have not been able to find the reason for this. i will try to keep my description as simple as possible. basically, i have set up three partner inbound connectors for testing purposes:

- inbound_any -> SenderDomains: {smtp:*;1} -> i would like to apply enhanced filtering on a connector like this, but enhanced filtering is currently not enabled for testing purposes.
- inbound_MyDomain1.com -> SenderDomains: {smtp:*.MyDomain1.com;1} -> no enhanced filtering on this connector.
- inbound_MyDomain2.com -> SenderDomains: {smtp:*.MyDomain1.com;1} -> no enhanced filtering on this connector.

since my goal is to understand what triggers which connector, i have not configured any restrictions (like SenderIPAddresses, RequireTls etc.) on those connectors. enhanced filtering is also turned off on all connectors currently. in fact, i have configured several domains per "MyDomainx"-connector, but i think this should not make a difference in this example. anyway, after having those connectors enabled for a few days and doing some testing, i observed some strange behavior i can not explain. what i did is:

Get-MessageTrace -SenderAddress <Sender> | Get-MessageTraceDetail -Event receive | fl

taking a look at the "Data"-fields returned, i noticed that:

on last thursday:
- emails from "email address removed for privacy reasons" sometimes show "'S:InboundConnectorData=Name=inbound_MyDomain1.com;ConnectorType=Partner;", while the others show "'S:InboundConnectorData=Name=inbound_any;ConnectorType=Partner;".
- emails from "email address removed for privacy reasons" sometimes show "'S:InboundConnectorData=Name=inbound_MyDomain2.com;ConnectorType=Partner;", while the others show "'S:InboundConnectorData=Name=inbound_any;ConnectorType=Partner;".
- emails from other domains usually show "'S:InboundConnectorData=Name=inbound_any;ConnectorType=Partner;", but some do not show any connector at all and seem to have used the hidden default connector.

today:
- emails from "email address removed for privacy reasons" all show "'S:InboundConnectorData=Name=inbound_MyDomain1.com;ConnectorType=Partner;".
- emails from "email address removed for privacy reasons": 15 show "'S:InboundConnectorData=Name=inbound_any;ConnectorType=Partner;", one shows "'S:InboundConnectorData=Name=inbound_MyDomain2.com;ConnectorType=Partner;".

i have no idea what causes this behavior. can anyone help me with this? and if anyone knows of a better way to look for which connector was used, please let me know.