Does Enabling DNSSEC and SMTP DANE Affect or Prevent Direct Send from Working in Microsoft 365?

AJ-4596 20 Reputation points
2026-09-02T20:54:11.59+00:00

Microsoft 365 has a Direct Send feature which allows an application or host to send unauthenticated email as an external email server directly to other email accounts in our domain.

Here is a description of how it works: https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365

We have a couple of our applications use Direct Send to send email alerts.

We are thinking about enabling DNSSEC and SMTP DANE for inbound emails as mentioned in this article: https://learn.microsoft.com/en-us/exchange/security-and-compliance/how-dane-secures-email

Enabling DNSSEC and SMTP DANE involves changing the MX record for the email server. The MX record is what Direct Send uses to send emails.

My question is does enabling DNSSEC and SMTP DANE affect or prevent Direct Send from working?

Exchange Online
Exchange Online

A cloud-based service included in Microsoft 365, delivering scalable messaging and collaboration features with simplified management and automatic updates.

0 comments
Answer accepted by question author
Kai-L 19,050 Reputation points Microsoft External Staff Moderator
2026-09-02T21:51:14.2866667+00:00

Dear AJ,

From my research, Enabling inbound DNSSEC and SMTP DANE should not inherently prevent Microsoft 365 Direct Send from working. However, because the enablement process changes your domain’s MX endpoint, you must update any application that has the old MX hostname configured as its Direct Send smart host. Direct Send uses:

  • Your Microsoft 365 MX endpoint
  • TCP port 25
  • No authentication
  • Internal Microsoft 365 recipients only 

During DNSSEC enablement, Enable-DnssecForVerifiedDomain returns a new MX value as DnssecMxValue, ending in mx.microsoft. The documented process then switches the new record to priority 0 and finally deletes the legacy record ending in mail.protection.outlook.com.

Therefore:

  • If the application performs a DNS lookup of your domain's MX record at send time, it should start using the new endpoint after DNS propagation.
  • If the old mail.protection.outlook.com hostname is entered directly in the application, update it to the new mx.microsoft value before you delete the legacy record.
  • Do not configure a fixed IP address, as the DNS hostname is required for the MX endpoint.

Microsoft makes this point explicitly for third-party systems that resubmit mail into Exchange Online: the relay must use a DNS lookup and the new mx.microsoft hostname created during enablement. The same principle applies to your Direct Send applications.

On DANE itself, validation is performed by a sending mail server that supports DANE when connecting to your receiving MX endpoint. Since TLS is optional for Direct Send and these applications are typically not DANE-aware, they can still connect to the Microsoft 365 MX endpoint as ordinary external SMTP senders. If an application did support DANE, it would need to retrieve the TLSA record, negotiate TLS successfully and validate the endpoint against that record, as DANE-aware senders defer or block delivery when DNSSEC validation fails or the certificate does not match.

In summary, DNSSEC and inbound SMTP DANE do not disable Direct Send. The principal risk is leaving applications configured with the old MX hostname after it has been removed. Update each application to the new value, and test before completing the MX cutover. You can validate them afterwards using the Run Tests: Send email using Microsoft 365 diagnostic in the Microsoft 365 admin center.

Worth flagging separately: Microsoft now notes that most customers do not need Direct Send, and an option to disable it by default is being worked on. If these alerts matter operationally, SMTP relay with a certificate-based inbound connector would be more durable.

I hope this helps. Let me know if you need anything else.

If the answer is helpful, please click "Yes" and kindly upvote it. If you have extra questions about this answer, please click "Comment".  

Note: Please follow the steps in the forum documentation to enable e-mail notifications if you want to receive the related email notification for this thread.  

Was this answer helpful?

1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.