cirsec Baselines
Esc
Microsoft 365 tenant · Exchange Online, Defender for Office 365 & mail DNS

Reject Direct Send messages that claim to come from the organization

When it fails: Anyone on the internet can send unauthenticated mail as an internal domain through Direct Send. Attackers deliver phishing that appears to come from a colleague by sending anonymously to the tenant MX endpoint with an internal sender address.

CB-M365-MAIL-010mediumactivemanualprofile hardened

Description

Exchange Online rejects Direct Send (RejectDirectSend $true): anonymous messages received on the tenant MX endpoint whose envelope sender (5321.MailFrom) is one of the organization's accepted domains are refused when they do not match an inbound connector (by sender IP address or certificate).

Devices and applications that legitimately send as an internal address (printers, scanners, line-of-business applications, third-party services) go through a partner inbound connector restricted to their IP address or certificate, or through authenticated submission.

Rationale

Direct Send was designed for multifunction devices but needs no authentication at all. Attackers use it to drop phishing that carries an internal sender address straight on the MX endpoint; internal-looking messages get less scrutiny from users and some filters. Rejecting Direct Send removes this path while keeping legitimate senders on an explicit connector.

Impact

Every device or service that relies on Direct Send stops delivering mail as soon as the setting is on. Before the change, find these senders in message trace (anonymous inbound messages with an internal sender) and create a partner inbound connector for each of them. Microsoft plans to make rejection the default for new tenants; the control may move to the baseline profile then.

Audit

  1. There is no portal page for this setting. Connect to Exchange Online PowerShell as at least a Global Reader.
  2. Run (read-only): 
    Get-OrganizationConfig | Format-List RejectDirectSend
Get-InboundConnector | Format-Table Name, Enabled, ConnectorType, SenderIPAddresses, TlsSenderCertificateName
  3. Fail if RejectDirectSend is False.

Remediation

  1. Identify the devices and services that use Direct Send: in the Exchange admin center, run a message trace on inbound messages whose sender is in an accepted domain and that were received anonymously, or ask the teams that own printers, scanners and applications.
  2. For each one, create a partner inbound connector in Mail flow > Connectors that identifies it by its public IP address or its TLS certificate.
  3. Connect to Exchange Online PowerShell as an Exchange Administrator and run: 
    Set-OrganizationConfig -RejectDirectSend $true
  4. Watch message trace and NDRs for a few days for forgotten senders.

Rollback

Set-OrganizationConfig -RejectDirectSend $false.

References

Mappings

FrameworkIDRelation
NIST SP 800-53 Rev. 55.1.1SI-8related
NIST SP 800-53 Rev. 55.1.1SC-7related

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

TaxonomyID
MITRE ATT&CKT1566
  • related CB-M365-MAIL-009 Disable SMTP AUTH client submission for the organization
  • related CB-M365-MAIL-036 Require TLS and restrict partners on Exchange Online connectors

People and lifecycle

Authors
Introduced inv0.1.0
Created, updated2026-10-24, 2026-10-24
Translationsfr