# Exchange Online’s Reject Direct Send setting blocks anonymous mail from your own domains: add partner connectors first > Exchange Online’s RejectDirectSend setting, off by default, rejects anonymous messages whose envelope sender uses one of the tenant’s accepted domains unless a mail flow connector attributes them. Devices and services that send as your domain need a partner connector first, and Microsoft plans to enable it by default for new tenants. - Canonical URL: https://update.dsesecurity.com/updates/exchange-online-reject-direct-send-setting-anonymous-own-domain-partner-connector/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-10-19T00:28:12+00:00 - Modified: 2026-10-19T01:55:08+00:00 - Last reviewed by DSE: 2026-10-19 - Resource type: Guide - DSE priority: Important - Topics: Cybersecurity, Microsoft 365 & Identity - Reading time: 2 minutes ## What you need to know Exchange Online’s RejectDirectSend setting, off by default, rejects anonymous messages whose envelope sender uses one of the tenant’s accepted domains unless a mail flow connector attributes them. Devices and services that send as your domain need a partner connector first, and Microsoft plans to enable it by default for new tenants. ## Potentially affected Microsoft 365 tenants, and the printers, scanners, alarm and camera systems, line-of-business applications and third-party services that send email as the organization’s own domain. ## DSE recommendation DSE recommends finding every device and service that sends as your domain, giving each a partner connector, and then turning on Reject Direct Send. ## Article Exchange Online’s RejectDirectSend setting, off by default, rejects anonymous messages whose envelope sender uses one of the tenant’s accepted domains unless a mail flow connector attributes them. Devices and services that send as your domain need a partner connector first, and Microsoft plans to enable it by default for new tenants. ## Source facts Microsoft’s Exchange Team post [Introducing more control over Direct Send in Exchange Online](https://techcommunity.microsoft.com/blog/exchange/introducing-more-control-over-direct-send-in-exchange-online/4408790), updated May 20, 2026, describes Direct Send as a way for on-premises devices, applications or third-party services to send mail to a tenant’s mailboxes using the customer’s own accepted domain without any authentication. Turning on the opt-in RejectDirectSend setting, which is False by default, blocks mail sent anonymously to the tenant with an envelope sender (P1 Mail From) matching an accepted domain; the P2 From header is not checked, and anonymous means not attributed to a mail flow connector. Senders that legitimately use Direct Send must be authenticated with a partner mail flow connector that matches their certificate, which Microsoft recommends, or their IP addresses, and the SPF record is a good starting point for finding them. Admins enable the setting with Set-OrganizationConfig -RejectDirectSend $true, which propagates within 30 minutes, and rejected messages receive 550 5.7.68 TenantInboundAttribution. Microsoft released the setting as a public preview, added a Change Optics Report in the Exchange admin center that shows Direct Send traffic, and plans to enable it by default for new tenants, which will not be able to turn it off. It warns that messages forwarded back through a provider without Sender Rewriting Scheme may be rejected without a connector, that the setting is not enabled for GCC-High, DoD and USNat/USSec environments, and that changing it requires the Organization Configuration role. ## Applicability Use this for Exchange Online tenants, including those whose MX record points to a third-party filtering service. Tenants in GCC-High, DoD and USNat/USSec cannot use the setting yet. ## DSE recommendation DSE recommends finding every device and service that sends as your domain, giving each a partner connector, and then turning on Reject Direct Send. Start from the SPF record and the Change Optics Report, prefer certificate-based connectors, move devices that can authenticate to authenticated submission, and watch for 550 5.7.68 rejections after the change. ## Verification Send a test message from each approved device or service and confirm message trace shows it attributed to the expected connector, then confirm an anonymous test from your domain is rejected. ## Official reference [Microsoft Exchange Team Blog — Introducing more control over Direct Send in Exchange Online](https://techcommunity.microsoft.com/blog/exchange/introducing-more-control-over-direct-send-in-exchange-online/4408790). Reviewed October 19, 2026. ## Primary reference - Name: Microsoft Exchange Team Blog — Introducing more control over Direct Send in Exchange Online - Authority: Microsoft - URL: https://techcommunity.microsoft.com/blog/exchange/introducing-more-control-over-direct-send-in-exchange-online/4408790 - Source publication date: Not stated by the source ## Citation and use Preferred citation: “Exchange Online’s Reject Direct Send setting blocks anonymous mail from your own domains: add partner connectors first,” DSE Security, https://update.dsesecurity.com/updates/exchange-online-reject-direct-send-setting-anonymous-own-domain-partner-connector/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.