Finally managed to extract our production domain out of an un-managed MS365 tenant, which got put there because someone made a trial. We could not add the domain to our main tenant, until we removed it from the test one. I need a drink.