Direct Send in Microsoft 365: when it works, how to set it up, and why it is being locked down

Direct Send is the path with zero configuration in Microsoft 365: the device connects to your tenant's MX host on port 25 and delivers mail to your own users, like any mail server on the internet would. That is also its limit. It cannot reach anyone outside your tenant, and Microsoft now treats it as something to switch off.

Does Direct Send fit your case?

Recipients	Only mailboxes in your tenant. Mail to Gmail, a customer or a vendor is rejected.
Device needs a login	No.
Device needs TLS 1.2	No. TLS is optional.
Licensed mailbox needed	No. Any address in an accepted domain.
Outbound TCP port 25	Yes. Blocked by many ISPs and by pay-as-you-go cloud subscriptions.
Static IP address	Recommended, because it must be in your SPF record. Otherwise the mail is scored like spam from an unknown host.
Spam filtering	Full. The mail is "just like anonymous email from the internet". Expect Junk without SPF, DKIM and DMARC.

Microsoft's own wording, October 2026: "Most customers don't need to use Direct Send. We're working on an option to disable Direct Send by default to protect customers." Use it for a scanner that mails scans to your own staff, nothing more.

Step 1. Check that Direct Send is allowed in your tenant

Since 2025 a tenant can reject Direct Send with one switch. If a colleague turned it on, the device gets 550 5.7.68 TenantInboundAttribution; Direct Send not allowed for this organization. Check in Exchange Online PowerShell:

Connect-ExchangeOnline
Get-OrganizationConfig | Format-List RejectDirectSend

False means allowed. If it is True, either keep it that way and use another path, or create an inbound connector for the device's IP address, which is therelay connector path. Turning the switch off for the whole tenant to serve one scanner is the wrong trade: it reopens spoofing of your own domain from the internet.

Step 2. Find your MX endpoint

Microsoft 365 admin center → Settings → Domains → your domain →DNS records → MX → Points to address:

contoso-com.mail.protection.outlook.com

Step 3. Put the device's public IP address in SPF

Add the public address the device uses to the TXT record of the sending domain. Without it, Exchange Online Protection scores the mail as spoofed and sends it to Junk, or quarantines it if your DMARC policy is reject.

v=spf1 include:spf.protection.outlook.com ip4:203.0.113.10 -all

With a dynamic address this step is impossible. Then Direct Send works only until the first spam verdict, and you should pick another path.

Step 4. Configure the device

Setting	Value
SMTP server or smart host	Your MX endpoint, for example `contoso-com.mail.protection.outlook.com`
Port	25
TLS or STARTTLS	Optional
Authentication	None
From address	Any address in an accepted domain, for example `scanner@contoso.com`. No mailbox needed.
To	Mailboxes, shared mailboxes or groups in your tenant only.

Step 5. Test and read the errors

Error	Meaning	Fix
`550 5.7.54 SMTP; Unable to relay recipient in non-accepted domain`	The recipient is outside your tenant. Direct Send cannot do that, by design.	Use the relay connector or another path that relays to the internet.
`550 5.7.68 TenantInboundAttribution; Direct Send not allowed for this organization`	The tenant has `RejectDirectSend` set to `True`.	Step 1. Create a connector for the IP address, or change path.
Mail in Junk or quarantine	SPF, DKIM or DMARC failed for the sending domain. The mail looks like spoofing of your own domain.	Step 3. Check the message headers for `spf=fail` and `compauth=fail`.
Connection timeout	Port 25 is blocked outbound.	Open it, or change path. Azure pay-as-you-go subscriptions cannot open it at all.

Why Microsoft is locking Direct Send down

Direct Send accepts mail from any host on the internet that claims a From address in your domain. Attackers used it in 2025 to deliver phishing to employees that looked internal. Microsoft answered with the RejectDirectSend setting, generally available since September 2025, and says it is working on making the rejection the default. Plan as if Direct Send will stop working for your tenant at some point without a connector.

If you want to close the door now:

Set-OrganizationConfig -RejectDirectSend $true

The change takes up to 30 minutes. Devices that relied on Direct Send then need one of the other paths.

When Direct Send cannot work

Any external recipient. Customer statements, order confirmations, vendor alerts.
Server in a cloud without port 25. Azure blocks outbound 25 except for Enterprise Agreement subscriptions.
Dynamic IP address. SPF cannot follow it, so the mail is scored as spoofing.
Tenant with RejectDirectSend on, which is where Microsoft is steering everyone.

For internal recipients from a cloud server, High Volume Emailis the replacement Microsoft intends. For external recipients from a device that can log in with TLS 1.2, Azure Communication Services Email. For a device that cannot do either, SMTP Bridge.

Sources: Microsoft Learn, How to set up a multifunction device or application to send email using Microsoft 365 or Office 365, updated October 2026; Exchange Team blog, "Introducing more control over Direct Send in Exchange Online", April 2025; Message Center MC1093237, general availability September 2025.