Does Enabling DNSSEC and SMTP DANE Affect or Prevent Direct Send from Working in Microsoft 365?

Question

Does Enabling DNSSEC and SMTP DANE Affect or Prevent Direct Send from Working in Microsoft 365?

AJ-4596 20

Microsoft 365 has a Direct Send feature which allows an application or host to send unauthenticated email as an external email server directly to other email accounts in our domain.

Here is a description of how it works: https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365

We have a couple of our applications use Direct Send to send email alerts.

We are thinking about enabling DNSSEC and SMTP DANE for inbound emails as mentioned in this article: https://learn.microsoft.com/en-us/exchange/security-and-compliance/how-dane-secures-email

Enabling DNSSEC and SMTP DANE involves changing the MX record for the email server. The MX record is what Direct Send uses to send emails.

My question is does enabling DNSSEC and SMTP DANE affect or prevent Direct Send from working?

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Dear AJ,

From my research, Enabling inbound DNSSEC and SMTP DANE should not inherently prevent Microsoft 365 Direct Send from working. However, because the enablement process changes your domain’s MX endpoint, you must update any application that has the old MX hostname configured as its Direct Send smart host. Direct Send uses:

Your Microsoft 365 MX endpoint
TCP port 25
No authentication
Internal Microsoft 365 recipients only

During DNSSEC enablement, Enable-DnssecForVerifiedDomain returns a new MX value as DnssecMxValue, ending in mx.microsoft. The documented process then switches the new record to priority 0 and finally deletes the legacy record ending in mail.protection.outlook.com.

Therefore:

If the application performs a DNS lookup of your domain's MX record at send time, it should start using the new endpoint after DNS propagation.
If the old mail.protection.outlook.com hostname is entered directly in the application, update it to the new mx.microsoft value before you delete the legacy record.
Do not configure a fixed IP address, as the DNS hostname is required for the MX endpoint.

Microsoft makes this point explicitly for third-party systems that resubmit mail into Exchange Online: the relay must use a DNS lookup and the new mx.microsoft hostname created during enablement. The same principle applies to your Direct Send applications.

On DANE itself, validation is performed by a sending mail server that supports DANE when connecting to your receiving MX endpoint. Since TLS is optional for Direct Send and these applications are typically not DANE-aware, they can still connect to the Microsoft 365 MX endpoint as ordinary external SMTP senders. If an application did support DANE, it would need to retrieve the TLSA record, negotiate TLS successfully and validate the endpoint against that record, as DANE-aware senders defer or block delivery when DNSSEC validation fails or the certificate does not match.

In summary, DNSSEC and inbound SMTP DANE do not disable Direct Send. The principal risk is leaving applications configured with the old MX hostname after it has been removed. Update each application to the new value, and test before completing the MX cutover. You can validate them afterwards using the Run Tests: Send email using Microsoft 365 diagnostic in the Microsoft 365 admin center.

Worth flagging separately: Microsoft now notes that most customers do not need Direct Send, and an option to disable it by default is being worked on. If these alerts matter operationally, SMTP relay with a certificate-based inbound connector would be more durable.

I hope this helps. Let me know if you need anything else.

If the answer is helpful, please click "Yes" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in the forum documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

AJ-4596 20 Reputation points

2026-09-03T15:09:39.8266667+00:00

Thanks, I especially like your suggestion of having each application use the new MX record before deleting the old record.
Kai-L 19,050 Reputation points Microsoft External Staff Moderator

2026-09-03T16:07:09.5233333+00:00

Dear AJ,

Thank you for your update. I’m glad I could provide you with helpful information. If you have any further questions or need additional assistance down the road, feel free to post back. Not only I, but other professionals in the forum are always here to help. Thank you again for being a valued member of the Q&A community and I wish you all the best!