Microsoft 365 Direct Send spoofing: what MSPs need to know
The easiest email to trust is one that looks like it came from a coworker. Microsoft reports attackers have used Direct Send spoofing more since May 2025, and it can slip past filters built for external mail.
How it works
Microsoft 365's Direct Send lets printers, scanners, copiers, security systems and other tools send email without user authentication. Microsoft says the feature itself is not the problem. Attackers exploit complex routing and misconfigured protections in Direct Send mail flows.
The result is email that appears to come from inside the organization, sometimes from the recipient themselves. Because it looks internal, it may bypass checks designed for external mail, including Microsoft's filtering and third-party tools that rely on sender reputation.
Why it works so well
Users are wary of strangers, not their manager or HR. Attackers use public information to reference real coworkers, projects and vendors, open with "Are you around?" and then follow up with a password reset request or a malicious QR code.
What a successful spoof costs
- Money: business email compromise caused more than $2.7 billion in losses in 2024.
- Credentials: access to email, cloud apps, client records and other systems.
- Compliance: violations and fines in regulated industries.
- Time: recovering from a phishing-driven breach takes an average of 254 days.
- Trust: vendors and partners start to doubt your client's real messages.
How to prevent it
- 1.Where possible, disable Direct Send and move legacy devices to modern authentication.
- 2.First, identify every device, app and workflow that relies on it, so legitimate mail keeps flowing.
- 3.Work with your email security provider to review incidents and validate mail flow.
- 4.Revisit the fundamentals: SPF, DKIM and DMARC. Mailprotector's Email Security Basics webinar series covers all three.