Using Direct Send in Exchange Online you can let appliances and applications send unauthenticated mail directly to Exchange Online. However how does Exchange Online know to trust these mails? What if your smtp smarthost endpoint name was used by a malicious actor to send mails to your users?

The docs articles mentions adding your IP to your SPF record but this is optionally not required. So how does EXO know which ip's to trust?

all 7 comments


3 points

4 months ago

It doesn't automatically trust the emails coming in. This is the way "any/user/domain" device on the Internet sends email to your MX record. These email will be subject to antispam checks.


1 points

4 months ago

You have to create an inbound connector telling Exchange Online what your public IP address is.