Direct Send RejectDirectSend Bypass via Null Reverse Path (MAIL FROM:<>)

Arnold Chan@slaz

•updated Sep 5, 2026•0•0•1

Detects the RejectDirectSend bypass (null SMTP envelope sender + internal-domain spoof). Tightened to require Microsoft's composite auth verdict OR all of SPF/DKIM/DMARC failing (vs. any one), excludes known-approved Direct Send relay IPs, and excludes likely-legitimate bulk/newsletter traffic via BulkComplaintLevel.