Translated from 日本語 • View original 
Key Points
The Direct Send feature in Microsoft 365 is enabled by default, and there is an attack risk for all enterprises. Unless you have any special settings, anyone can be targeted by an attack using this feature.
What is Direct Send?
Direct Send is one of the SMTP features of Microsoft 365 that allows you to send emails via Exchange Online without external authentication.
Main Applications:
- Scan notification email from MFP
- Alert notifications from the application
- Internal email sending
Example: SMTP server = company-com.mail.protection.outlook.com
While this feature is useful, it **does not authenticate, so there is a risk of abuse. **
Phishing Tactics Using Direct Send
Attackers exploit Direct Send in the following ways:
- Exploiting or Acquireing M365 Tenants
- Use Direct Send to send emails that "spoof the sender name or domain"
- Many security products come from Exchange Online
Example: The Content of a Spoofed Email
Subject: Please check as soon as possible: Update internal materials
Full text: Log in from the link below to check the materials.
Link: 'https://malicious.example-login.com'
Recent Developments
- Since 2024, many cases of abuse of Direct Send have been reported in Japan
- Using the M365 environment of small and medium-sized enterprises as a stepping stone, attacks targeting business partners have become apparent.
- Domains without SPF/DKIM/DMARC are vulnerable to exploitation
How to Deal with
1. Restricting and Disabling Direct Send
- Apply IP restrictions in connector settings
- Changed to SMTP authentication method and made sender authentication mandatory
- If not in use, it is best to disable it completely
- Enable the deny function to disable (**check the impact on your business!) **）
Set-OrganizationConfig -RejectDirectSend $true
2. Enhanced Email Authentication (SPF, DKIM, DMARC)
- SPF: Set up a configuration to allow source IPs and restrict emails to only trusted IPs. For Direct Send, allow Microsoft's IP range.
- DKIM: Allows email tampering to be detected by granting electronic signatures. Effective in finding tampering due to external attacks.
- DMARC: Provides policy controls and allows email recipients to handle fraudulent emails. It is recommended to strengthen it step by step with "none→ "quarantine"→ and "reject".
3. Leverage Microsoft Defender for Office 365
- Inspect URLs and attachments with Safe Links/Safe Attachments
- Set up an identity detection policy
- Indicator detection of attack campaigns
Impact and Precautions
It is recommended to monitor with none first, understand the actual situation from the logs, and then apply it in stages.
- Disable Direct Send: You may not be able to send emails from MFPs or business apps, so check the scope of impact in advance.
- Enhanced SPF: Set it carefully, as misconfigurations can prevent legitimate emails from being delivered.
- DMARC "reject" application: There is a risk that emails may not arrive due to false positives, so it is recommended to monitor none first, understand the actual situation from logs, and then apply it in stages.
⚠ > **Rather than immediately "completely blocking", it is recommended to first monitor with 'none' and understand the actual situation from the logs before applying it in stages. **
Conclusion
Direct Send is a convenient but very dangerous feature that works without any configuration.
If left unattended, there is a risk that your company will be used as a stepping stone for phishing, which can result in damage to the trust of customers and business partners.
Check **it out now! **
- Are you using Direct Send in-house?
- Are there IP restrictions in the connector settings?
- Is SPF/DKIM/DMARC properly configured?
Security is based on "stopping unused functions" and "visualizing and monitoring". Review now and try to operate your email safely.