How to Set Up SMTP Relay in Microsoft 365

To set up SMTP relay in Microsoft 365, create an inbound connector that identifies your sending device by a TLS certificate or an exclusive static public IP address, then configure the device to send to your domain’s MX endpoint on port 25. Microsoft recommends certificate authentication when your sending server or device supports it.

You need an Exchange Online organization and administrator access to create the connector. You do not need a sending mailbox, but Microsoft 365 Personal and Family subscriptions do not provide this organizational relay feature.

Get the relay requirements ready

Choose how Microsoft 365 will recognize your sender before opening the connector wizard. For certificate authentication, the sending server’s certificate Subject or Subject Alternative Name must match the accepted domain you enter in the connector. For IP authentication, you need the public IP address used by your device or application, and that address must be static and belong exclusively to your organization.

Confirm that your sending network allows outbound TCP port 25. Dynamic public IP addresses are unsupported for IP authenticated relay. Enter the public sending address in the connector rather than the device’s private network address.

Check where your application runs before choosing connector relay. Microsoft’s general relay guidance excludes ordinary third-party-hosted applications, including Azure-hosted applications. Its separately documented certificate integration for qualifying email processing services does not extend that permission to arbitrary hosted apps.

Find your domain’s MX endpoint

Open the Microsoft 365 admin center, then select Show all > Settings > Domains. Select the domain you will send from and confirm that its Status is Healthy. Open DNS records, select MX, and copy Points to address or value.

Save that value for the device’s outgoing server configuration. Connector relay uses this domain-specific MX endpoint as its server or smart host. The smtp.office365.com endpoint belongs to authenticated SMTP submission, which is a separate sending method.

Create a certificate authenticated connector

For Microsoft’s recommended option, open the Exchange admin center and select Mail flow > Connectors > Add a connector. Under Connection from, select Your organization's email server. Confirm that Connection to is Office 365, then select Next.

Enter a descriptive Name so you can identify the connector later. Check Turn it on and uncheck Retain internal Exchange email headers. Select Next to reach Authenticating sent email.

Select By verifying that the subject name on the certificate that the sending server uses to authenticate with Office 365 matches the domain entered in the text box below (recommended). Enter the accepted domain that matches the sending certificate’s Subject or Subject Alternative Name. Select Next, then select Create connector.

The certificate presented by your sending server must match the domain configured here. If you use a null or third-party envelope sender, choose certificate authentication. Matching only the visible From address does not satisfy the relay requirements.

Create a static IP authenticated connector

Choose this option instead of certificate authentication when you have an exclusive static public IP address. In the Exchange admin center, open Mail flow > Connectors > Add a connector. Under Connection from, select Your organization's email server, confirm that Connection to is Office 365, and select Next.

Enter the connector’s Name, check Turn it on, and uncheck Retain internal Exchange email headers. Select Next. On Authenticating sent email, select By verifying that the IP address of the sending server matches one of the following IP addresses which belong exclusively to your organization.

Enter the device or application’s exclusive static public IP address. Select Next, then select Create connector. If you plan to update a suitable existing connector instead, review its configuration before changing it, especially when it is shared with a hybrid setup.

Enter the outgoing mail settings on your device

Open your device or application’s email configuration. Depending on the product, these controls may be on its screen, in its browser interface, in a companion utility, or in a configuration file. Microsoft says the labels vary, so match the settings below to the fields your device provides.

Set Server/smart host to the MX endpoint you copied from Microsoft 365, and set TCP port to 25. Enable TLS/StartTLS with TLS 1.2 or TLS 1.3. For Email address, enter a sender address in one of your organization’s accepted domains.

For IP authenticated relay, make sure the SMTP envelope sender, also called the MAIL FROM address, uses an accepted domain. Relay attribution requires an accepted domain in the SMTP certificate or envelope sender, together with a matching source IP address or certificate on an OnPremises inbound connector. The visible From address alone is insufficient.

Update the domain’s SPF record

Open your DNS provider’s management portal and edit the sending domain’s existing SPF TXT record. Include ip4:<public-IP>, replacing the placeholder with your relay’s public sending IPv4 address. Preserve entries for other legitimate senders, and keep one SPF record per domain.

For a Worldwide Microsoft 365 domain, the following example includes both the relay’s IPv4 address and Microsoft 365. Replace the placeholder before saving, and preserve any additional entries your domain already needs.

v=spf1 ip4:<public-IP> include:spf.protection.outlook.com -all

Government and 21Vianet clouds use different Microsoft SPF include domains. Use the include appropriate to your cloud rather than copying the Worldwide example into those environments. Your DNS provider’s menu labels determine where you edit the TXT record.

Send a test and check delivery

After completing the connector, device, and DNS configuration, send a test message from the device or application to a recipient outside your Microsoft 365 organization and confirm that it arrives. Direct Send can deliver to internal recipients without a relay connector, but Microsoft says it can't deliver email to external recipients, so only an outside test shows the relay works. If delivery fails, compare the configured server with your domain’s MX value, confirm port 25, and check that TLS 1.2 or 1.3 is enabled. Also confirm that the connector is turned on.

For an IP connector, compare its configured address with the actual public sending IP and confirm that the address remains static and exclusive. For a certificate connector, compare the certificate’s Subject or Subject Alternative Name with the accepted domain entered in the wizard. Check that your envelope sender or certificate also meets the accepted-domain requirement.

Microsoft offers guided help for a new configuration or an existing setup. Open its device email troubleshooting page and select Run Tests: Send email using Microsoft 365. In the Microsoft 365 admin center flyout, choose the option for your setup task.

Keep these checks focused on your connector and sending configuration. Enabling mailbox SMTP AUTH does not create a relay connector, and you do not need to disable Microsoft Entra security defaults for certificate or IP connector relay.

Frequently Asked Questions

What does an application need to use OAuth SMTP submission?

Your application must authenticate using SASL XOAUTH2, and SMTP AUTH must be enabled for the Exchange Online mailbox. A custom application using delegated access requests the SMTP.Send permission, while an unattended application using application-only access needs SMTP.SendAsApp and administrator configuration. These are authenticated submission options, separate from connector relay.

Does Direct Send need a connector or mailbox login?

No, your device sends anonymously without a relay connector or mailbox login. External recipients are rejected, and your organization can also block Direct Send through its RejectDirectSend setting. Microsoft reserves this approach for advanced customers with otherwise incompatible devices.

Does High Volume Email need a mailbox license?

Your HVE account does not need a mailbox license, but it needs a valid billing policy to send. Configure the application for smtp.hve.mx.microsoft on port 587 with TLS. HVE supports its own account credentials or OAuth, and its password authentication is separate from mailbox SMTP AUTH.

Can you follow an old IIS SMTP Server tutorial on Windows Server 2025?

No, Microsoft removed SMTP Server and IIS 6 Management Console from Windows Server 2025, which has no built-in SMTP Server replacement. Use a supported mail server or another supported sending method instead. Microsoft also identifies the Windows Server/IIS SMTP feature as unsupported for relay to Microsoft 365.