ReliaQuest finds Microsoft 365 email control bypass

ReliaQuest has identified a way for attackers to bypass a Microsoft 365 email control in Exchange Online by leaving the SMTP envelope sender blank. The technique has appeared repeatedly in phishing investigations across multiple organisations.

The finding centres on RejectDirectSend, a Microsoft 365 control designed to block unauthenticated Direct Send emails that use an organisation's own domain. The control checks the domain in the SMTP envelope sender, but an empty value leaves no domain for the system to evaluate.

As a result, an external sender can omit the envelope domain while still showing an internal-looking address in the visible From field. According to the research, that can make phishing messages appear more trustworthy, especially when they seem to come from internal support teams, executives or other familiar business contacts.

Direct Send is commonly used by printers, scanners and software applications to send messages within the same Microsoft 365 tenant without authentication. ReliaQuest said the issue it observed is not a software flaw in Microsoft's platform, but a limit in the control's scope.

Test results

In testing, ReliaQuest compared two unauthenticated messages sent directly to a Microsoft 365 tenant. One used an envelope sender with the tenant's accepted domain. The other used an empty envelope sender, also known as a null reverse path.

The baseline message was rejected. The message with the empty sender was accepted and queued, while still presenting the same internal IT support address in the visible From field.

Changing only the envelope sender was enough to alter how Microsoft 365 handled the message, ReliaQuest said. The accepted message was later delivered to Junk Email rather than the inbox, but that reflected downstream filtering decisions rather than the operation of RejectDirectSend itself.

Email headers from the accepted test message showed failed authentication checks, including SPF, DKIM and DMARC, and marked the message as anonymous incoming mail with a Spam Confidence Level of 9. Even so, ReliaQuest argued that acceptance into the tenant's mail system still showed that the Direct Send control had been bypassed.

Targeted users

ReliaQuest identified numerous examples of the empty-envelope pattern over the past year. In those cases, attackers often used self-addressed messages and routine business themes to target executives, managers and users in customer-facing or finance-related roles.

Document-sharing alerts and file notifications were the most common lures, followed by payment requests, remittance messages, procurement invitations, loan and investment offers, and meeting invitations. Some emails used SVG attachments disguised as voicemail recordings.

These themes fit normal workplace activity and can give users a plausible reason to open a file, click a link or act on a financial request, ReliaQuest said. It added that procurement and customer-facing mailboxes are particularly attractive because they routinely receive messages from unfamiliar external senders.

In one investigated case, a message failed all sender authentication checks and was marked as high-confidence phishing, but still reached the inbox because the spoofed executive address had been listed as an allowed sender. ReliaQuest said that made filtering exceptions a significant trust decision, especially when they cover senior or frequently impersonated users.

Control limits

The research also found that other mail controls behave differently from RejectDirectSend. During testing, an IP-restricted inbound connector blocked every Direct Send attempt regardless of the envelope sender because it relied on the source IP address rather than the sender field.

That suggests organisations already restricting inbound mail to approved source IPs are not exposed to this specific route, according to ReliaQuest. It also points to a layered approach to email security rather than reliance on a single Microsoft 365 setting.

Blocking all empty envelope senders would be impractical because null reverse paths are a legitimate part of SMTP and are widely used for non-delivery reports. As a result, defenders need to distinguish between expected system traffic and suspicious messages that pair an empty envelope sender with an internal From address.

ReliaQuest recommended that organisations allow Direct Send only from approved IP addresses, review mail-filtering exceptions such as allowed senders and safe sender lists, and monitor for messages that combine an empty envelope sender with failed authentication and internal impersonation.

It also urged organisations to remove unnecessary mail-filtering exceptions: "Review every setting that can override a filtering verdict, including allowed senders, allowed sender domains, Tenant Allow and Block List entries, mail flow rules that set spam confidence, and user-level safe senders. Record whether each entry covers one address or a whole domain, identify any that name an executive or manager, and remove those you can't justify."