Microsoft 365 RejectDirectSend Control Bypass via Null Envelope

ReliaQuest researchers have identified a bypass for the Microsoft 365 'RejectDirectSend' security control, which is intended to block unauthenticated Direct Send emails originating from an organization's own domain. By omitting the SMTP envelope sender (using a null reverse path, `MAIL FROM:<>`), external attackers can bypass the domain-based rejection logic while maintaining a trusted, internal-looking address in the visible `From` header. This technique facilitates highly credible spearphishing without requiring registered lookalike domains or compromised credentials.

Between September 2025 and August 2026, multiple phishing campaigns were observed utilizing this bypass to target executives and finance departments with lures related to payment requests and file sharing. While Microsoft has been notified, the behavior is characterized as a limitation in the control's scope rather than a software vulnerability. Because the bypass relies on a legitimate SMTP function used for non-delivery reports, blanket blocking of null senders is often impractical, necessitating layered defense strategies.