Microsoft Exchange Online: New Reject Direct Send parameter (preview)

Direct Send is a method used to send emails directly to a Microsoft Exchange Online customer’s hosted mailboxes from on-premises devices, applications, or third-party cloud services using the customer’s own accepted domain. It is an advanced method of sending messages to your users and requires proper configuration of SPF, DKIM, and DMARC to ensure messages are delivered successfully.

Many customers do not need to use Direct Send. Because SPF protections do not always outright block messages and sometimes deliver them to the Junk folder, it is possible for malicious senders mimicking Direct Send to have their messages that spoof your own domains land in the Junk folder and potentially confuse your users. Before this rollout, no feature existed to block Direct Send traffic for customers who have no need to use it. We will roll out the new Reject Direct Send setting for Exchange Online.

When this will happen:

Public Preview: Available now.

General Availability (Worldwide, GCC, GCC High): We will begin rolling out early September 2025 and expect to complete by early September 2025.

How this will affect your organization:

Direct Send covers anonymous messages sent from your own domain to your organization’s mailboxes and so enabling this setting will block any of that traffic. Direct Send traffic may include third-party services that you have given permission to use your domain or one of your own email applications hosted on-premises. To avoid having these messages rejected when this feature is enabled, they need to be authenticated. You can authenticate them by creating a partner mail flow connector for these messages.

What you need to do to prepare:

This rollout has happened automatically by the specified dates with no admin action required before the rollout. Review your current configuration to assess the impact on your organization. You may want to notify your users about this change and update your relevant documentation.

By default, the new opt-in RejectDirectSend setting is set to False. To enable the Reject Direct Send feature, Exchange Online admins can run this Microsoft PowerShell cmdlet:

Set-OrganizationConfig -RejectDirectSend $true

The change should propagate out to your entire service within 30 minutes. With the feature enabled, any received Direct Send messages will see the following message:

550 5.7.68 TenantInboundAttribution; Direct Send not allowed for this organization from unauthorized sources

Unless you re-enable Direct Send, any messages that hit this error will need a partner connector created to authenticate their source as an approved sender.

Learn more: Introducing more control over Direct Send in Exchange Online | Microsoft Community Hub

We invite Exchange admins to try out the feature and provide feedback that we can use to validate and proceed to offering this feature for General Availability.