Michael,
We’ve found that MS-DFSC, section 4.1, which relates to Domain Referral, describes the method in which a client gets a list of domains via referral request with a NULL name. MS-DFSC sections 2.2.2 / 3.1.6 / 3.1.5.4 also provide some more context around this process.
As a result of your query we have suggested to the documentation team that they add a link or note in the doc to make this easier to find.
Please let me know if this answers your questions or if we need to follow up in any way.
Regards,
Jim Reynolds – MSFT