A user received messages that appeared to come from their own address. The headers show the mail was accepted directly by Exchange Online, rather than passing through the Proofpoint MX route. What settings should I check to close that path?
How do I stop spoofed mail from reaching M365 around Proofpoint?
Asked by
M2.Veltrick
Answers
Start with Exchange Online’s inbound mail flow. Configure the Proofpoint connector according to its Microsoft 365 guidance so messages for your domain are accepted only from Proofpoint’s authorized sending IPs. Then make sure other direct inbound routes are rejected. An MX record points senders toward Proofpoint, but by itself it does not prevent delivery straight to Exchange Online.
Reply to this answer
Check whether Direct Send is enabled and whether you actually need it. It can allow unauthenticated mail to reach the tenant through Microsoft’s own infrastructure, which makes simple source-IP blocking a poor fit. If your setup does not rely on it, disabling it is a useful step, but still verify the inbound connector restrictions rather than assuming one toggle covers every bypass.
Reply to this answer
Also review every inbound connector, including defaults and older ones. A permissive connector can undermine the Proofpoint route even if the MX records look correct. Test the intended setup with an external message that bypasses Proofpoint, and confirm it is rejected before it reaches a mailbox.
Reply to this answer
The header’s DMARC failure is worth investigating, but don’t treat it as proof that enforcement is working. The message still arrived, so check the tenant’s anti-spoofing and DMARC handling alongside the connector rules. The main fix is to prevent unauthorized direct delivery, not just to adjust how a failed authentication result is scored.
Reply to this answer
Add your answer
Answers are reviewed before publication.
M2.Veltrick:
So the key is restricting the tenant’s inbound path, not just changing the public MX record?