Hunt – Direct Send Empty Envelope Sender ( M365 )

Ankit Mehta@Secvyn

•updated Sep 5, 2026•5•0•2

Detects incoming emails where the SMTP envelope sender (MAIL FROM) is blank, but the visible 'From' header displays an internal/accepted domain. This technique is often used to bypass email authentication filters. The rule specifically alerts on cases where SPF, DKIM, or DMARC checks failed or returned 'none', yet the message was still delivered to an inbox or folder, suggesting a configuration gap or allow-list override.