What you need to know
Exchange Online’s RejectDirectSend setting, off by default, rejects anonymous messages whose envelope sender uses one of the tenant’s accepted domains unless a mail flow connector attributes them. Devices and services that send as your domain need a partner connector first, and Microsoft plans to enable it by default for new tenants.
Potentially affected
Microsoft 365 tenants, and the printers, scanners, alarm and camera systems, line-of-business applications and third-party services that send email as the organization’s own domain.
DSE recommendation
DSE recommends finding every device and service that sends as your domain, giving each a partner connector, and then turning on Reject Direct Send.
Exchange Online’s RejectDirectSend setting, off by default, rejects anonymous messages whose envelope sender uses one of the tenant’s accepted domains unless a mail flow connector attributes them. Devices and services that send as your domain need a partner connector first, and Microsoft plans to enable it by default for new tenants.
Source facts
Microsoft’s Exchange Team post Introducing more control over Direct Send in Exchange Online, updated May 20, 2026, describes Direct Send as a way for on-premises devices, applications or third-party services to send mail to a tenant’s mailboxes using the customer’s own accepted domain without any authentication. Turning on the opt-in RejectDirectSend setting, which is False by default, blocks mail sent anonymously to the tenant with an envelope sender (P1 Mail From) matching an accepted domain; the P2 From header is not checked, and anonymous means not attributed to a mail flow connector.
Senders that legitimately use Direct Send must be authenticated with a partner mail flow connector that matches their certificate, which Microsoft recommends, or their IP addresses, and the SPF record is a good starting point for finding them. Admins enable the setting with Set-OrganizationConfig -RejectDirectSend $true, which propagates within 30 minutes, and rejected messages receive 550 5.7.68 TenantInboundAttribution.
Microsoft released the setting as a public preview, added a Change Optics Report in the Exchange admin center that shows Direct Send traffic, and plans to enable it by default for new tenants, which will not be able to turn it off. It warns that messages forwarded back through a provider without Sender Rewriting Scheme may be rejected without a connector, that the setting is not enabled for GCC-High, DoD and USNat/USSec environments, and that changing it requires the Organization Configuration role.
Applicability
Use this for Exchange Online tenants, including those whose MX record points to a third-party filtering service. Tenants in GCC-High, DoD and USNat/USSec cannot use the setting yet.
DSE recommendation
DSE recommends finding every device and service that sends as your domain, giving each a partner connector, and then turning on Reject Direct Send. Start from the SPF record and the Change Optics Report, prefer certificate-based connectors, move devices that can authenticate to authenticated submission, and watch for 550 5.7.68 rejections after the change.
Verification
Send a test message from each approved device or service and confirm message trace shows it attributed to the expected connector, then confirm an anonymous test from your domain is rejected.
Official reference
Microsoft Exchange Team Blog — Introducing more control over Direct Send in Exchange Online. Reviewed October 19, 2026.
Review the official source
Microsoft Exchange Team Blog — Introducing more control over Direct Send in Exchange Online · Verified October 19, 2026
Need help applying this guidance safely?
DSE can help confirm applicability, protect service continuity, and validate the result across physical security and IT systems.
Talk with DSE