Update 8/12/2025: Added the FAQ to the post. Also, to help shed more light on the Direct Send feature, we published a newer post called Direct Send vs sending directly to an Exchange Online tenant.
...
Updated Aug 29, 2025
Version 12.0
Blog Post
What happens to all the e-mail notifications from different M365 services (Teams, Voicemails, Planner Activities, Document Comments, ...)? Microsoft is pushing these mails into the Exchange Online tenant and ignoring the MX records, which are pointing to somewhere else (mailboxes are also on-prem).
From my point of view, these e-mails are delivered via Direct Send to the tenant. And yes, many of these e-mails they are sent from an Accepted Domain of the tenant!
Arindam_Thokder
Microsoft
MicrosoftEmails which are directly pushed to Mailbox does not go through Transport, so they won't get blocked. Also, most of the notifications are sent using Microsoft.com address and also Auth-as will be Internal (reaction notification for example), these won't be impacted either. If you have an example where notification email is sent using your accepted domain and auth-as is anonymous. Please share with us and we can work with the particular notification team to fix the issue.
PIM emails from entra aren't send. Maybe there is more but it's quiet hard to name something missing.
before your change those PIM related emails where send. they are sent to m365adminaccount_at_ourcompany.onmicrosoft.com and then forwarded to our user accounts onpremuseraccount_at_ourcompany.com (we don't allow admins to have to direct email accounts for security reasons).
further example when everything worked:From: Microsoft Security <MSSecurity-noreply_at_microsoft.com> Subject: PIM: You now have the Contributor role Resent-From: <m365adminaccount_at_ourcompany.microsoft.com> ARC-Authentication-Results: i=2; mx.microsoft.com 1; spf=pass (sender ip is 2a01:111:f403:c206::3) smtp.rcpttodomain=ourcompany.onmicrosoft.com smtp.mailfrom=microsoft.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=microsoft.com; dkim=none (message not signed); arc=pass (0 oda=0 ltdi=1) Received: from AS9PR06CA0324.eurprd06.prod.outlook.com (2603:10a6:20b:45b::13) by FR6P281MB4444.DEUP281.PROD.OUTLOOK.COM (2603:10a6:d10:134::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8989.16; Fri, 1 Aug 2025 07:31:58 +0000 Received: from AM2PEPF0001C70C.eurprd05.prod.outlook.com (2603:10a6:20b:45b:cafe::f3) by AS9PR06CA0324.outlook.office365.com (2603:10a6:20b:45b::13) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8989.14 via Frontend Transport; Fri, 1 Aug 2025 07:31:57 +0000 Authentication-Results: spf=pass (sender IP is 2a01:111:f403:c206::3) smtp.mailfrom=microsoft.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=microsoft.com;compauth=pass reason=100 Received-SPF: Pass (protection.outlook.com: domain of microsoft.com designates 2a01:111:f403:c206::3 as permitted sender) receiver=protection.outlook.com; client-ip=2a01:111:f403:c206::3; helo=CWXP265CU009.outbound.protection.outlook.com; pr=C Received: from CWXP265CU009.outbound.protection.outlook.com (2a01:111:f403:c206::3) by AM2PEPF0001C70C.mail.protection.outlook.com (2603:10a6:20f:fff4:0:12:0:8) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9009.8 via Frontend Transport; Fri, 1 Aug 2025 07:31:57 +0000Unless I am missing something I have not found this to be true. With a Transport rule in place to reject messages sent from external to internal, messages from 'noreply-at-skype.voicemail.microsoft.com' or 'Office365Reports-at-microsoft.com' or 'mirm365-at-microsoft.com' or 'no-reply-powerbi-at-microsoft.com' all get rejected unless I put in an exception for them. So it seems to me that they are going through Transport. Another one is noreply-at-yammer.com.
- Arindam_Thokder
My response was related to these emails getting blocked because of RejectDirectSend setting (not the Transport rule). None of these emails are sent using an Accepted Domain of the tenant, so Reject Direct send setting won't block them.
Thanks for clarifying. I misunderstood this statement "Emails which are directly pushed to Mailbox does not go through Transport"
Thank you for your quick response.
Please think about the feature "Send email notifications from your domain" (https://learn.microsoft.com/en-us/microsoft-365/admin/email/select-domain-to-use-for-email-from-microsoft-365-products?view=o365-worldwide). With this setting, the sender address gets changed to an own e-mail address. I'm unsure about the Auth-as value, I have to check some examples.I have an update on the M365 notifications with a custom domain! In the message header I see a X-MS-Exchange-Organization-AuthAs = Internal.
Can you confirm, that these e-mails are delivered even when Direct Send is disabled!? Arindam_Thokder
Edit: Another thing is really confusing me... the failing SPF check is getting ignored completely, why!?- Arindam_Thokder
They should not be impacted. There could be many reasons for falling SPF being ignored - MX not pointing to EXO definitely influence it a lot. But it is very difficult to find the exact cause without analyzing all the data like header, message trace, policy settings, DNS Records etc.
