# (L2) Ensure Direct Send submissions are rejected

Exchange Online rejects Direct Send submissions: unauthenticated messages sent to your tenant where the envelope sender (MAIL FROM) domain is one of your…

Source: https://maester.dev/docs/tests/CIS.M365.6.5.5

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jeremyfinney-lgtm" title="jeremy finney · Original author"><img src="https://github.com/JeremyFinney-lgtm.png" alt="jeremy finney" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jeremyfinney-lgtm">jeremy finney</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Exchange Online · Mail flow · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.6.5.5
```

## Overview

Exchange Online rejects Direct Send submissions: unauthenticated messages sent to your tenant where the envelope sender (MAIL FROM) domain is one of your accepted domains and no eligible inbound connector matches the message.

Direct Send lets a device or application send mail to your tenant, from an address in your own domain, without signing in. Attackers use the same path to send phishing that looks like internal mail. When `RejectDirectSend` is turned on, Exchange Online rejects these messages instead of delivering them. It does not reject every anonymous message that shows an internal sender address. For example, a message can use an external envelope sender and still show one of your addresses in the From header. Anti-spoofing controls such as SPF, DKIM, DMARC and spoof intelligence are still needed for those messages.

Before you turn it on, find the devices and applications that rely on Direct Send, for example printers and scanners. Move them to authenticated SMTP submission, SMTP relay with a connector or High Volume Email.

#### Remediation action

1. Connect to Exchange Online with `Connect-ExchangeOnline`.
2. Run `Set-OrganizationConfig -RejectDirectSend $true`.
3. Check the setting with `Get-OrganizationConfig | Format-List RejectDirectSend`.

#### Related links

* [Direct Send: Send mail directly from your device or application to Microsoft 365](https://learn.microsoft.com/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365#direct-send-send-mail-directly-from-your-device-or-application-to-microsoft-365-or-office-365)
* [Set-OrganizationConfig](https://learn.microsoft.com/powershell/module/exchange/set-organizationconfig)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - 6.5.5](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.6.5.5 |
| Severity | Medium |
| Suite | CIS |
| Product | Exchange Online |
| Feature | Mail flow |
| Area | Email and collaboration protection |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1566 Phishing, T1684.002 Email Spoofing |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 6.5.5 |
| Benchmark level | L2 |
| Benchmark profiles | E3 Level 2 |
| Supports controls | cis-m365:6.5.5, nist-800-53-r5:SI-8 |
| PowerShell test | [Test-MtCisDirectSendRejected](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.6.5.5.ps1) |
| Services | ExchangeOnline |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.6.5.5.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.6.5.5.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.6.5.5.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.6.5.5.md)