After our recent post Introducing more control over Direct Send in Exchange Online, there have been more questions about scenarios that are not actually Direct Send such as senders being able to igno...
Updated Aug 07, 2025
Version 7.0
Blog Post
Dear Community
I would like one thing to be clarified, as it confuses me. In case of scenario where MX record points directly to M365 (company.mail.onmicrosoft.com) - what happens if I set RejectDirectSend to true? Does it stop also "normal", legitimate emails from Gmail for example, from being delivered to internal recipients?
Sorry if it seems to be a stupid question but I see some ambiguity around "Direct Send" term. Some people refer to it only in the context of emails with MailFrom (P1) address belonging to an internal (accepted) domain. But if I read it properly, Direct Send endpoint is responsible for all emails delivered to M365, if MX points to Microsoft. I will be grateful for clarification.
Best Regards
Marcin
- Mithun_Rathinam
Microsoft
Marcin K. No, if you set RejectDirectSend to $True, it will block any anonymous messages sent from your own domain to your organization’s mailboxes that are not routed through an inbound connector. This setting does not affect emails from external domains like gmail.com.
- Direct Send: Refers to anonymous messages sent from your own domain to your organization’s mailboxes. Direct Send emails could be sent to the MX record endpoint we provide contoso-com.mail.protection.outlook.com) or the endpoint that 3rd party service provide so that emails first route to them.
- Email sent directly to your public Exchange Online endpoint: This refers to any anonymous messages from external senders (e.g., gmail.com) sent to the EXO Public endpoint directly, (ex: contoso-com.mail.protection.outlook.com) even when MX is pointed to 3rd party.
Why haven't you included a report or query for those of us with MX pointed directly to Exchange Online? You have left us with no visibility into emails that are a significant security risk. The queries provided are returning all emails, which is not helpful.
Their comment form won't take KQL because it thinks its HTML injection, but try the query i posted up here.
https://bsky.app/profile/chrislehr.com/post/3lvovftew7c27
