RejectDirectSend is an Exchange Online mail-flow control designed to reject anonymous email that appears to come from a tenant’s own accepted domain. It is meant to reduce abuse of Direct Send, a weaker delivery path used by some legacy devices and applications that do not authenticate with user credentials. When enabled and working as intended, it helps Exchange Online decide whether an incoming message has a legitimate trust path or is merely pretending to be internal.
This setting matters because sender identity is one of the first signals users and security tools rely on. If anonymous mail can look internal, attackers may use it for phishing, impersonation, invoice fraud, or help-desk abuse. Defenders use RejectDirectSend alongside authenticated SMTP submission, inbound connectors, and domain audits to tighten trust boundaries. In practice, its value depends on correct mail-flow design and on reducing or eliminating unauthenticated paths where possible.