What is the specific PowerShell command used to prevent external entities from sending emails to your tenant using your own domain names?
Why is it necessary to enable "Enhanced Filtering for Connectors" when you have already locked down your tenant to only accept mail from a third-party gateway?
If an organization enables RejectDirectSend $true but forgets to update their SPF record to include their legitimate third-party sending services, what is the likely impact on outbound mail delivery?
+12Let me know if this community blog entry helps:Β Mind the Gap: How to Lock Down Exchange Online Direct Send and Prevent Gateway Bypass
There is no one PowerShell command to block external entities from sending emails with your domain to your Exchange Online organization. It depends on how you have configured it. You should have SPF, DKIM and DMARC correctly configured. You should not have your own domains as allowed in any of the policies in Exchange Online Protection/Defender for Office 365. You can also create an Exchange Transport Rule which block emails coming from outside the organization and which have your own domain name.Β
Even after locking down your tenant to only accept mail from a third-party gateway (like Mimecast or Proofpoint), Microsoft still needs to see the original source IP of the sender to perform its own security checks. When mail passes through a third-party gateway, the "last hop" IP seen by Exchange Online is that of the gateway, not the original sender. Without Enhanced Filtering, Exchange Online's anti-spam and anti-phishing filters (EOP) would evaluate the reputation of your gateway rather than the actual sender.
If you enable RejectDirectSend $true but forget to update your SPF record to include your legitimate third-party sending services (e.g., HubSpot, Salesforce, or on-premise scanners), the impact depends on how those services are connected:
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
