Guides

Direct Send spoofing: block it in Microsoft 365, then fix DMARC

Last updated 2026-09-28

Attackers are mailing Microsoft 365 users as their own colleagues by connecting straight to the tenant and using Direct Send, which needs no sign-in. KnowBe4 counted 29,785 of these messages across July and August 2026.

Does DMARC stop Direct Send spoofing? Only at p=quarantine or p=reject. At p=none, Microsoft 365 takes no action based on DMARC.

1. Find out what uses Direct Send today. Scanners, line-of-business apps and outside services that mail your own staff as your domain are the usual ones.
2. Give each real sender a connector. With an inbound connector, by certificate or by IP address, Microsoft 365 accepts your device's mail as your own.
3. Turn on Reject Direct Send. The command is below, and it applies within 30 minutes.
4. Move your DMARC policy off p=none. That covers the receivers Reject Direct Send can't, which is everyone outside your tenant.

Direct Send lets anyone mail your users as your domain

Microsoft's page on sending mail from devices describes Direct Send as sending unauthenticated email as an external email server directly to Microsoft 365. The sender connects to your MX endpoint, something like contoso-com.mail.protection.outlook.com, on port 25. It needs no sign-in and no connector.

It exists for scanners and old applications. On the same page, Microsoft says most customers don't need it and that it is working on an option to turn it off by default. An attacker can connect the same way and put your CEO's address in the From line.

Find Direct Send mail in your tenant

Open the headers of a suspicious message that claims to come from inside your company, and look for this header.

Mail that a colleague sent from their mailbox has Internal there. In the spoofed message, the Authentication-Results header also shows spf=fail, no DKIM signature and dmarc=fail. KnowBe4's write-up of the 2026 campaign found the most common sender names were hr, admin, no-reply, accounting and meeting.

Block it with Reject Direct Send

Run this in Exchange Online PowerShell.

Microsoft's announcement of the setting says the change applies within 30 minutes and that the setting is off until you turn it on. After that, Microsoft 365 refuses unauthenticated mail that uses one of your accepted domains, and the sender gets this error.

Mail that arrives through a connector is still accepted. That is why step 2 comes first. An outside service that mails your staff as your domain, such as a ticketing system or a payroll provider, gets the same rejection until you create a partner connector for it.

Why a policy of p=none still delivers the spoof

The spoofed message fails DMARC, and what Microsoft 365 does next depends on your own record. Microsoft's anti-phishing policy page says that at p=none it takes no action based on DMARC. At p=quarantine or p=reject, with the Honor DMARC record policy setting on, it quarantines or rejects the message.

If your MX record points at a filtering service in front of Microsoft 365, that page adds a condition. The setting applies only when Enhanced Filtering for Connectors is on. Direct Send goes around the filtering service, because the attacker connects to Microsoft 365 directly.

Get to p=reject without blocking your own mail

Reject Direct Send protects your own tenant. A policy of reject protects everyone else who receives mail that uses your domain. The risk in tightening it is the sender you forgot, and the scanner from step 1 is a good example. DMARC aggregate reports list every server that sends as your domain and whether it passed. DomainCanary reads those reports for you, and your first domain is free. On the paid plans, we propose each policy change when your reports show it's safe, and you approve it before we publish it. The guide to moving to p=reject has the checks to run either way.

DomainCanary is a DMARC monitoring service that protects your domain from email spoofing without blocking your own mail.