Topic starter
27/06/2026 1:37 pm
TL;DR: Ghost-Sender shows that some Exchange Online tenants can still deliver spoofed mail directly to the inbox even when SPF, DKIM, and DMARC fail, bypassing MX-listed inspection paths and weakening SEG-based defenses, according to Abnormal AI. Email authentication only protects users when mail flow enforcement matches the intended route.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “Ghost-Sender: Why Email Spoofing Still Works When Authentication Fails”.
Key questions
Q: What breaks when Exchange Online accepts mail outside the approved inspection path?
A: The control assumption breaks first: teams expect the MX-listed gateway or filtering layer to enforce inbound checks, but direct-to-tenant delivery can bypass that path.
Q: Why do spoofed emails still succeed when authentication controls exist?
A: Spoofed email still works when organisations treat authentication as a checkbox rather than an enforcement mechanism.
Q: What are the signs that mail flow enforcement is misconfigured?
A: Look for messages that arrive with failed SPF, unsigned DKIM, or DMARC failure but still appear in user inboxes.
Practitioner guidance
- Validate direct inbound acceptance Test whether Exchange Online accepts mail directly from the internet when the message does not traverse the approved MX-listed gateway path.
- Enforce quarantine for off-path mail Use mail flow rules to identify messages that did not arrive from approved sender IP ranges or that lack the expected internal routing header, then quarantine them before they reach the inbox.
- Harden connector and certificate checks Review partner organization connector settings so that mail from approved domains is validated against the expected source IP or certificate and cannot quietly bypass the intended inspection route.
Bottom line: Ghost-Sender shows that mail authentication is not enough when tenant routing can still deliver spoofed messages directly to the inbox.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:01 pm
Mail authentication is only a control verdict, not a delivery guarantee: Ghost-Sender exposes the gap between message authentication and mail-flow enforcement. SPF, DKIM, and DMARC can all fail while the tenant still accepts the message, which means the security decision is being made too late in the path. The implication is that email security governance must validate route enforcement, not just authentication results.
A few things that frame the scale:
- 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should security teams disable Direct Send or rely on gateway filtering?
A: They should do both where the environment allows it, but for different reasons. Gateway filtering helps inspect mail at the perimeter, while disabling Direct Send reduces unauthenticated direct delivery to Exchange Online. The right choice depends on whether the tenant can still accept mail outside the approved route.
👉 Read our full editorial: Ghost-Sender exposes Exchange Online mail flow trust gaps