Microsoft 365 550 5.7.68: “Direct Send not allowed for this organization from unauthorized sources”

Short answer: The receiving Microsoft 365 organization has Reject Direct Send turned on, so unauthenticated mail sent straight to its MX host with its own domain as sender is refused. Fix: authenticate the printer or service with a connector (IP or certificate), or move it to OAuth.

The bounce looks like this
550 5.7.68 TenantInboundAttribution; Direct Send not allowed for this organization from unauthorized sources

What it means

Direct Send means a printer, scanner, app or third-party service delivers to your MX host (…mail.protection.outlook.com) on port 25 with no login, using your own domain as the sender. Spoofers abuse the same path, so Microsoft added the RejectDirectSend setting (preview June 2025, worldwide rollout from September 2025). It is off by default; once an admin turns it on, Direct Send mail that isn't authenticated by a connector bounces with 5.7.68, about 30 minutes after the change. Microsoft also says it is working on turning Direct Send off by default, so devices that rely on it should move now.

How to fix it

  1. Check the setting in Exchange Online PowerShell: Get-OrganizationConfig | Format-List RejectDirectSend. True means Direct Send from unauthenticated sources is blocked.
  2. Printers, scanners and apps in your office: create a connector that recognises them by your static public IP or a TLS certificate – the same connector as in the relay connector set-up. Mail that matches it is authenticated.
  3. Third-party services that send as your domain (ticketing, CRM, scanning or signature services): Microsoft's fix is a partner mail flow connector that authenticates them by IP or certificate. Or have the service send through its own authenticated route with SPF and DKIM for your domain (see the setup guides).
  4. Devices that can sign in: use SMTP AUTH with OAuth on smtp.office365.com, port 587. Our device pages show which printers and apps support it.
  5. Last resort, if you accept the spoofing risk: Set-OrganizationConfig -RejectDirectSend $false turns the block off again.
  6. Mail forwarded to you by outside systems without SRS can hit this too; a partner connector for that source fixes it.

Step-by-step for your device or app

Not sure which devices still log in with a password? Run the free read-only script that lists every SMTP AUTH sender in your tenant.

Several devices to move? The Microsoft 365 SMTP Fix Kit puts every printer, scanner, app and script on one printable guide: decision table, relay connector set-up, per-device steps, a sender worksheet and a checklist.

Get the kit ($19)

Rather have it done for you? I move your devices and apps on Fiverr – relay, Direct Send or OAuth, tested, from $25.

Check your domain now

After the fix, send a test email to see SPF, DKIM and DMARC pass on a real message, then keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.

Rather not touch DNS? I set up SPF, DKIM and DMARC without breaking your other senders, with a before/after report.

Get it fixed on Fiverr

Prefer to do it yourself? Get the step-by-step Fix Kit ($15) – 28-page guide, checklist, 20+ providers.

Did this fix it?

What's still not working?

Paste the bounce message or describe what happens. We read every report and add fixes for new errors.

Other bounce errors