diff --git a/ircd/m_event.cc b/ircd/m_event.cc
index e64fcf2d8..eb09bf292 100644
--- a/ircd/m_event.cc
+++ b/ircd/m_event.cc
@@ -2005,22 +2005,6 @@ ircd::m::event::auth::failed(const m::event &event,
 		auth_power? *auth_power : m::event{}, *auth_create
 	};
 
-	// 4. If type is m.room.aliases:
-	if(json::get<"type"_>(event) == "m.room.aliases")
-	{
-		// a. If event has no state_key, reject.
-		assert(!conforms(event).has(conforms::MISMATCH_ALIASES_STATE_KEY));
-		if(empty(json::get<"state_key"_>(event)))
-			return "m.room.aliases event is missing a state_key.";
-
-		// b. If sender's domain doesn't matches state_key, reject.
-		if(json::get<"state_key"_>(event) != m::user::id(json::get<"sender"_>(event)).host())
-			return "m.room.aliases event state_key is not the sender's domain.";
-
-		// c. Otherwise, allow
-		return {};
-	}
-
 	// 5. If type is m.room.member:
 	if(json::get<"type"_>(event) == "m.room.member")
 	{
diff --git a/modules/m_room_aliases.cc b/modules/m_room_aliases.cc
index cc296bff6..ab2f74a7a 100644
--- a/modules/m_room_aliases.cc
+++ b/modules/m_room_aliases.cc
@@ -8,9 +8,18 @@
 // copyright notice and this permission notice is present in all copies. The
 // full license for this software is available in the LICENSE file.
 
+namespace ircd::m
+{
+	static void auth_room_aliases(const event &, event::auth::hookdata &);
+	extern hookfn<event::auth::hookdata &> auth_room_aliases_hookfn;
+
+	static void changed_room_aliases(const event &, vm::eval &);
+	extern hookfn<vm::eval &> changed_room_aliases_hookfn;
+}
+
 using namespace ircd;
 
-mapi::header
+ircd::mapi::header
 IRCD_MODULE
 {
 	"Matrix m.room.aliases"
@@ -43,7 +52,7 @@ alias_fetch_timeout
 };
 
 //
-// hook handlers
+// create the alias room as an effect of !ircd created on bootstrap
 //
 
 const m::hookfn<m::vm::eval &>
@@ -60,14 +69,14 @@ _create_alias_room
 	}
 };
 
-static void
-_changed_aliases(const m::event &event,
-                 m::vm::eval &);
+//
+// an effect of room aliases changed
+//
 
-const m::hookfn<m::vm::eval &>
-_changed_aliases_hookfn
+decltype(ircd::m::changed_room_aliases_hookfn)
+ircd::m::changed_room_aliases_hookfn
 {
-	_changed_aliases,
+	changed_room_aliases,
 	{
 		{ "_site",    "vm.effect"       },
 		{ "type",     "m.room.aliases"  },
@@ -75,8 +84,8 @@ _changed_aliases_hookfn
 };
 
 void
-_changed_aliases(const m::event &event,
-                 m::vm::eval &)
+ircd::m::changed_room_aliases(const m::event &event,
+                              m::vm::eval &)
 {
 	const m::room::id &room_id
 	{
@@ -115,6 +124,48 @@ _changed_aliases(const m::event &event,
 	}
 }
 
+//
+// auth handler
+//
+
+decltype(ircd::m::auth_room_aliases_hookfn)
+ircd::m::auth_room_aliases_hookfn
+{
+	auth_room_aliases,
+	{
+		{ "_site",    "event.auth"      },
+		{ "type",     "m.room.aliases"  },
+	}
+};
+
+void
+ircd::m::auth_room_aliases(const event &event,
+                           event::auth::hookdata &data)
+{
+	using FAIL = m::event::auth::FAIL;
+	using conforms = m::event::conforms;
+
+	// 4. If type is m.room.aliases:
+	assert(json::get<"type"_>(event) == "m.room.aliases");
+
+	// a. If event has no state_key, reject.
+	if(empty(json::get<"state_key"_>(event)))
+		throw FAIL
+		{
+			"m.room.aliases event is missing a state_key."
+		};
+
+	// b. If sender's domain doesn't matches state_key, reject.
+	if(json::get<"state_key"_>(event) != m::user::id(json::get<"sender"_>(event)).host())
+		throw FAIL
+		{
+			"m.room.aliases event state_key is not the sender's domain."
+		};
+
+	// c. Otherwise, allow
+	data.allow = true;
+}
+
 //
 // m::room::aliases
 //