Sending Emails with Different Domains Using Direct Mail Injection in Office 365

Question

I have configured Direct Mail Injection (DMI) with Microsoft Office 365.

However, I would like to send emails using a domain that is different from the organization's domain. Our intention is to phish the users for security training purpose.

When I attempt to set the sender's email address to the other domain, I encounter the following error:
The user account which was used to submit this request does not have the right to send mail on behalf of the specified sending account. Cannot submit message.

Answer 1

Microsoft 365 has a built-in service for that: https://learn.microsoft.com/en-us/defender-office-365/attack-simulation-training-simulations

Using this guarantees that the message will be ingested in the user's mailbox, bypassing any hygiene features. With any other method you risk the service marking the message as phish, deleting it, or even blocking your tenant for repeated offenses.

Answer 2

Hi @ Dharmaraj Kurle，

Thanks for posting your question in the Microsoft Q&A forum.

According to your description, you want to phish a user, and when you try to set the sender's email address to a different domain, you get the error message "The user account used to submit this request does not have permission to send mail on behalf of the specified sending account. The message could not be submitted." When configuring DMI, did the user you used have application impersonation and application administrator permissions set? In addition, if you want to phish a user for security training purposes, I agree with Vasily Michev that you can try to simulate a phishing attack using attack simulation training:

1. In the Microsoft Defender portal, go to Email and Collaboration > Attack Simulation Training > Simulation tab.
2. On the Simulation tab, select Launch a simulation.
3. On the Select Technology page, select an available social engineering technology.
4. Follow the wizard to select the payload and landing page, target users, assign training, end-user notifications, simulation launch details, etc. Just like the screenshot:

Refer to: Simulate a phishing attack with Attack simulation training - Microsoft Defender for Office 365 | Microsoft Learn

If you have any questions, please feel free to contact me. If the answer is helpful, please click "Accept Answer" because it can help other members of the Microsoft Q&A community who have encountered similar problems and are looking for solutions. Thank you.

Best,

Jeanne