Troubleshooting: Microsoft 365 "Reject Direct Send" Errors

If your order notifications are being blocked by a client's Microsoft 365 environment with the error 550 5.7.68 TenantInboundAttribution; Direct Send not allowed, it indicates that the client has the "Reject Direct Send" security setting enabled. This setting blocks emails that claim to originate from the customer's own domain when they arrive from an outside server without an established inbound connector.Recommended Solution: Configure an Inbound Connector

The most secure way to resolve this is to allow the mail server traffic through an inbound connector in the client's Microsoft 365 account.

1. Log in to the Exchange admin center.
2. Navigate to Mail flow > Connectors.
3. Create a new connector with the following configuration:
   • From: Partner organization
   • To: Office 365
4. Identify the sending servers by authorizing the IP range: 103.121.35.64/27.
    

For more information see this Microsoft Info Page - the Office 365 mail flow connector setup for partner organizations

Alternative Solutions

• Disable Direct Send Blocking: You can request that the customer disable the "Reject Direct Send" restriction. Note that this is less secure as it weakens the tenant's inbound filtering defenses:
  • Command: Set-OrganizationConfig -RejectDirectSend $false.
     
• Use a Different Sender Address: Update the system to send notification emails from a neutral domain (e.g., your own system domain) rather than the customer's domain. Set the Reply-To header to the customer's email address (e.g., orders@customerdomain.co.nz) so that replies from the recipient go to the correct destination.