Spamming Microsoft 365 Like It’s 1995 

This report presents research on abusing Microsoft 365 Exchange Online’s Direct Send smart host to spoof emails and deliver device code phishing messages, showing that default Exchange Online Protection produces inconsistent outcomes across tenants. Through controlled tests varying sender domains, encodings (ASCII, UTF-32, UTF-7), subjects, and IPs, the author demonstrates that messages alternately land in inbox, junk, or quarantine, heavily influenced by sender domain authentication (SPF/DKIM/DMARC) and proprietary Microsoft filtering. Header analysis highlights differences in spam confidence scoring, and large-scale tests confirm inconsistent filtering across tenants. The report recommends hardening by restricting Direct Send smart host usage to specific IPs or certificates and urges ongoing validation of inbound email defenses.