What you’re seeing
- Staff receive fake voicemail alerts, invoices or DocuSign-style requests that show a coworker's name and your own company address as the sender.
- The message headers show it arrived from an outside IP address, yet no account in your tenant was signed into or compromised.
- Messages pass straight into the inbox, sometimes without the external sender warning tag.
- Password resets reveal no suspicious sign-ins, which leaves everyone confused about how the email was sent.
Common causes
Every environment is different, but these are the causes our engineers find most often:
- Microsoft 365 Direct Send accepts unauthenticated mail addressed to your own users through your MX endpoint, a feature meant for copiers and apps.
- The domain's DMARC policy is set to none, or there is no DMARC record at all, so spoofed mail claiming your domain is not rejected.
- SPF ends in a soft fail, which tells receiving systems to treat a failure as suspicious rather than reject it.
- Direct Send was never restricted because an old scanner or app relied on it, and the newer setting to reject Direct Send has not been turned on.
- Attackers deliberately pick internal-looking senders because staff trust email from colleagues more than outside contacts.
Why it matters
An email that appears to come from the office manager or the owner is far more convincing than one from a stranger, so these campaigns have high click rates. A single employee entering their password on a fake sign-in page can lead to a real account takeover, invoice fraud or a ransomware foothold. Because no account was actually breached, the attack often goes unexplained and unaddressed, and it keeps arriving. Cyber insurers and clients increasingly expect DMARC enforcement, so leaving the gap open can also cause compliance trouble.
How AskTechGurus fixes it
Skip the trial and error. A certified engineer works on your actual system, finds the root cause, and fixes it properly.
Tell us what’s happening
Submit a ticket in about two minutes. Paste the error, describe what changed, and pick your tier. No charge to submit.
A certified engineer diagnoses it
A vetted, US-based systems engineer claims your ticket, usually within minutes during business hours, and investigates over a secure remote session you can watch and end at any time.
Fixed and verified with you
The engineer resolves the root cause and confirms with you that it’s working. You don’t just get a workaround, and you get a plain-English summary of what was wrong.
Pay only when it’s resolved
Fixed price from $99, invoiced only after you approve the fix. If it isn’t resolved, you don’t pay.
Frequently asked questions
Does this mean one of our accounts was hacked?
Not necessarily. Direct Send spoofing lets attackers forge your address without touching any account, though anyone who clicked a link and entered a password should be treated as possibly compromised.
Will blocking this break our copier or other apps?
It can, if those devices still rely on Direct Send. That is why the devices that send as your domain need to be identified and moved to an authenticated method before spoofed mail is rejected.
What does AskTechGurus do here?
A certified US engineer reviews how your domain's mail is authenticated and which systems depend on Direct Send, working through a remote secure session. Service starts from $99 and you pay only when it's resolved.