Topic starter
14/07/2026 4:26 pm
TL;DR: Microsoft Direct Send lets devices and apps send email through Exchange Online without user credentials, but that convenience also lets attackers spoof domains and push phishing or fraud through trusted Microsoft infrastructure, according to Proofpoint. The security gap is not delivery, it is unauthenticated trust in non-human mail flows.
Editorial analysis by NHI Mgmt Group, based on content published by Proofpoint: “The hidden risk of Microsoft Direct Send: why you need a secure email relay”.
Key questions
Q: What breaks when application mail uses Direct Send without authentication?
A: The sender identity control breaks, because the message can arrive through trusted infrastructure without proving that the application or device was authorised to send it.
Q: Why does unauthenticated mail relay increase spoofing risk?
A: Because the receiving systems are validating delivery path more than sender identity.
Q: How can security teams tell whether application mail is properly governed?
A: Look for a single approved relay, documented ownership, authenticated sending sources, signed messages, and the ability to disable a sender centrally.
Practitioner guidance
- Audit all Direct Send usage Inventory scanners, printers, line-of-business apps, and scripts that still send through Exchange Online without authenticated sender identity.
- Route application mail through a controlled relay Move device and application messages to a secure relay that enforces authentication, policy checks, logging, and revocation for non-human senders.
- Enforce SPF, DKIM, and DMARC alignment Require signed application mail and configure sending domains so outbound messages can be validated and inbound spoofing can be rejected.
Bottom line: Direct Send exposes a governance gap where non-human mail can travel through trusted infrastructure without proving sender identity.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 4:33 pm
Direct Send is a non-human identity governance problem, not just an email transport choice. The article shows that application-generated mail can bypass the sender assurance expected in modern controls. That means the real issue is whether non-human mail flows are inventoried, authenticated, and lifecycle-managed like other machine identities. Practitioners should treat every application mail path as part of identity governance.
A question worth separating out:
Q: Should organisations replace Direct Send with a secure relay for all non-human mail?
A: Where messages matter for brand trust, internal deception risk, or compliance, yes. A secure relay does not just change a technical route, it establishes sender accountability, policy enforcement, and consistent signing for application and device mail. Direct Send may remain convenient, but convenience is a poor control when spoofing is the threat.
👉 Read our full editorial: Microsoft Direct Send creates spoofing risk for application mail