Why are spoofed internal emails still getting through with direct send disabled?

Start with the full headers and message trace for an affected message. The visible From address can be spoofed, so it doesn't establish that the message came from that user or distribution list.

Check Authentication-Results, X-MS-Exchange-Organization-AuthAs, the original recipient, and whether an inbound connector matched. A rejected test from your own computer only shows that your test path was blocked. If the message reached the tenant directly without a matching connector, bring the trace and headers to Microsoft support.

If your public MX points to a third-party gateway, check whether someone can still deliver straight to the Microsoft 365 tenant. Review the inbound connectors and the gateway's guidance for locking down direct delivery. The goal is to accept inbound internet mail through the intended gateway without accidentally breaking legitimate routes.

Rejecting direct send doesn't prevent someone from putting your domain in the visible From address and sending through another inbound path. Check SPF and DKIM results and whether either aligns with the From domain for DMARC. You can block unauthenticated messages claiming your domain at the gateway, then consider a DMARC reject policy once legitimate senders are aligned.

For a quicker containment step, consider a mail flow rule that catches unauthenticated messages claiming to be from your domain. Test it against legitimate mail flows first. That can reduce exposure while you work out the entry path, but it won't explain how the message bypassed the gateway.