Direct Send is a Microsoft 365 sending method for devices or applications that submit mail directly to the organization's mail endpoint. Microsoft describes it as unauthenticated mail from an external email server.這使得路由歸
區分支持的方法
Microsoft 目前的比較包括用戶端SMTP提交、 SMTP中繼、直接傳送和大容量電子郵件。它們的身份驗證和接收範圍不同；本次調查的重點是直接發送。 Microsoft 將SMTP中繼描述為使用入站連接器，而直接傳送未經身份驗證，無法透過Microsoft 365中繼到外部收件者。直接發送郵件被視為匿名網路郵件，並套用掃描和保護。 Microsoft 傳送方法指南.
An internal recipient and port 25 are clues, not conclusive proof of a specific device or configuration. A legitimate external sender can also deliver mail to that recipient. Avoid calling the route an open relay merely because inbound mail was accepted. Check what the service accepted, which recipient scope was involved and what trusted evidence identifies the path.
收集特定路線的證據
要求授權管理員保留原始郵件並檢查相關寄件者、收件者和時間視窗的郵件追蹤。追蹤記錄支持收貨、處理和交付的調查；他們的欄位應該與原始欄位相關，而不是被視為商業意圖的證明。 Microsoft 訊息追蹤文檔.
Record trusted authentication results, source details available to the receiver, connector or rule involvement where observable and the final action. Review configured devices and applications with their owners. A source IP alone may identify an egress point shared by several systems. Preserve unknowns if the available trace or headers do not establish the responsible application.
避免錯誤的補救措施
不要添加未知來源 SPF 只是為了驗證可疑訊息。 SPF authorization is a security decision about an intended sender. Do not create a broad connector or allow rule based solely on a display name or From address. DMARC 結盟 and content safety remain separate questions even for mail delivered to an internal mailbox. RFC 9989.
Microsoft 的文件警告說，直接發送需要仔細管理，並建議在適當的情況下考慮其他受支援的方法。產品預設值和控制項可能會變更；在套用變更之前驗證租用戶的目前設定和目前的 Microsoft 指南。本指南並未聲明跨租戶普遍啟用或停用的直接發送設定。
閱讀有界調查範例
In written case DEMO-DIRECT-01, assume visible From scanner@brand.test and recipient operations@brand.test in the organization.連接 IP、實際信封身分和 DKIM 不提供簽章域。 Anonymous inbound delivery is a hypothesis, not an observed trace finding. It deliberately records trace not queried, connector unknown and trusted authentication not exported. Its result is Direct Send hypothesis, notentication not exported. Its result is Direct Send hypothesis, notentication not exported. Its result is Direct Send hypothesis, notentication not exported. Its result is Direct Send hypothesis, notentication not exported. Its result is Direct Send hypothesis, notentication not exported. Its result is Direct Send hypothesis, notentication notsis, notentication confirmed.因此，在将消息归因于扫描仪或声明连接器受损之前，该案例请求授权接收方导出和库存关联。
No Microsoft tenant was accessed, no message was sent and no route was blocked.經過真實證據審查後，透過負責的郵件所有者的流程進行任何更改。 Test legitimate device mail and the intended protection, document rollback and verify the observed result. Closing a route blindly may interrupt alerts while leaving the original abuse mechanism untouched.
設定有界證據請求
建議的郵件所有者請求對事件時間和收件人進行授權跟踪，並保留查詢時區和報告類型。然後，設備所有者將觀察到的路線與批准的設備設定進行比較。在這些記錄存在之前，來源歸屬和連接器參與情況都是未知的。 Do not broaden permissions just to obtain a more convenient report;使用權限最小的授權角色。此範例中未推斷出任何租戶預設值。