Read time: 8 minutes
Summary: To configure Microsoft 365 SMTP Relay, create an inbound connector in Exchange Admin Center, authenticate using either a TLS certificate or a static public IP, configure your application to use your Microsoft 365 MX endpoint on port 25 with TLS enabled, validate the connector, and test mail flow.
If you are a Microsoft user, you might have familiarity with the Office 365 SMTP relay. But setting up a Microsoft 365 SMTP relay is not just an ordinary setting. It requires different phases, from proper planning to execution as well as testing. However, to setup Office 365 SMTP relay, you can follow two ways:
- Using Exchange Admin Center
- Using PowerShell Commands
In this detailed guide, we’ll cover almost everything from prerequisites to the step-by-step process to setup SMTP relay in Office 365, post-setup verification, and best practices as well.
What is Microsoft 365 SMTP Relay & How Does It Work?
Office 365 SMTP relay is a mail delivery method that enables trusted devices and applications to send emails through Exchange Online using a configured connector instead of authenticating with a mailbox username and password.
Unlike SMTP AUTH, SMTP relay authenticates the sending device through:
- A trusted TLS certificate
- A static public IP address
Once authenticated, Exchange Online accepts emails from the trusted sender and routes them to internal or external recipients according to your organization’s mail flow policies.
Because it doesn’t ask or require storing mailbox credentials on every device, SMTP relay is commonly used for enterprise applications:
- Printers
- Scanners
- Monitoring tools
- Automated notification systems
The email delivery with connector process follows a secure path, and the SMTP connector is the only thing that verifies that the sending device is authorized before allowing emails to flow through Exchange Online.
Benefits of Setting Up Microsoft 365 SMTP Relay
From MSMEs to SME and even large organizations prefer SMTP relay because it provides both flexibility and security from end to end. A few benefits are:
- Protects messages during transmission between the application and Microsoft 365.
- Devices don’t need individual credentials, like usernames or passwords.
- Legacy applications don’t support OAuth or Modern Authentication but can still use SMTP relay.
- Helps in centralized mail flow means all outbound emails pass through Exchange Online.
- Even a single SMTP relay connector can securely serve multiple trusted devices and applications.
Prerequisites Before You Setup Office 365 SMTP Relay
Preparation before execution is a smart strategy. Before you configure the Office 365 SMTP connector, verify the following requirements for an uninterrupted Office 365 SMTP relay setup process.
| Requirement | Why It Matters |
|---|---|
| Microsoft 365 subscription | Required for Exchange Online |
| Exchange Admin permissions | Needed to create connectors |
| Exchange Online enabled | Required for mail flow |
| Static Public IP (optional) | Used for IP-based authentication |
| Trusted TLS Certificate | Required for certificate-based connector |
| Valid Accepted Domain | Exchange accepts sender domains |
| Firewall Configuration | Allows outbound SMTP traffic |
| Internet Connectivity | Required for secure mail delivery |
Office 365 SMTP Relay Deployment Checklist
The checklist also helps to make you certain of the process. Use this checklist before you start to set up Office 365 SMTP relay connector:
- Exchange Online is working correctly.
- You have Global Admin or Exchange Admins permissions.
- Your accepted domains are verified.
- Public DNS records are configured.
- Your firewall allows outbound SMTP traffic.
- TLS certificate is installed (if using certificate authentication).
- Static public IP is documented (if using IP authentication).
- The sending application supports TLS.
- Mail flow rules have been reviewed.
How to Set Up Office 365 SMTP Relay Using TLS Connectors
Now that you’ve planned enough for SMTP relay settings for Office 365. Let’s now move to how to configure Office 365 SMTP relay in Exchange Online. Between these two ways, you can opt for at your convenience:
- Exchange Admin Center (EAC)
- Exchange Online PowerShell
Method 1: Setup Office 365 SMTP Relay Using Exchange Admin Center
With Exchange Admin Center, you get a graphical interface; any user with the necessary permissions can create Office 365 SMTP connector. Here are the steps to follow:
- Sign in to the Microsoft 365 Admin Center.
- Move to Admin centers > Exchange. Select Mail flow and tap on Connectors.
- Click Add a connector (+) and configure the connector as below and click Next.
Setting Box Value to Put From Your organization’s email server To Microsoft 365 Connector Name Office 365 SMTP Relay Connector Description Secure SMTP Relay for applications and devices - Choose between Certificate-Based or IP Address-Based authentication method that you want:
Note: Choose Certificate-Based Authentication if your application supports TLS certificates:
- Select Identify the sender using a certificate.
- Enter the certificate subject name.
- Check the certificate is issued by a trusted Certificate Authority.
- Enable TLS.
For enterprise applications and hybrid mail environments, it is ideal.
Note: Choose IP Address Authentication if your application does not support certificates:
- Select Verify sender by IP address.
- Enter your organization’s static public IP address.
- Save the connector.
- In the review page, carefully verify the connector name, authentication method, accepted domains, security settings, and TLS configuration. Once verified, click on Create Connector.
Exchange Online will create the SMTP relay connector for Office 365.
Method 2: Use Exchange Online PowerShell to Setup Microsoft 365 SMTP Relay
Admins who manage multiple connectors often prefer PowerShell. However, it requires a set of commands to execute; only command-line experts can perform them accurately. The commands are:
- First, connect to Exchange Online by executing the command below:
Connect-ExchangeOnline
When asked, sign in using an Exchange Admin account.
- Now, create an inbound connector using the command below:
$ConnectorParams = @{
Name = “On-Premises App SMTP Relay”
ConnectorType = “OnPremises”
SenderDomains = “*”
SenderIPAddresses = “192.0.2.55”, “192.0.2.56” # Replace with your public static IPs
RestrictDomainsToIPAddresses = $true Enabled = $true
}
New-InboundConnector @ConnectorParams
Replace the certificate name with the subject of your trusted TLS certificate.
- Verify the connector you’ve created. For that, run:
Get-InboundConnector
- Now, review Connector details by executing the command:
Get-InboundConnector “Office365 SMTP Relay” | Format-List
Note: Verify TLS & connector enabled along with certificate name and sender domains.
How to Configure SMTP Relay Settings for Your Application
With the above methods, you’ve created the connector successfully; now configure your application, printer, or server. For assistance, below are the required SMTP relay settings for Office 365 that are commonly used:
| Setting | Configuration to Make |
|---|---|
| SMTP Server | Your Microsoft 365 MX Endpoint |
| Encryption | TLS |
| SMTP Authentication | None (Connector Authentication) |
| Sender Address | Accepted Microsoft 365 Domain |
| Authentication Method | TLS Certificate or Static Public IP |
| Timeout | Default Application Value |
Verify Microsoft 365 SMTP Relay Configuration
After the configuration has been done, validate the setup, and then try to use it in production. To test if SMTP relay is working, simply send a test message from your application both in an internal mailbox & external mailbox, and make sure that both recipients receive the email. Below are a few parameters on which you can verify the SMTP relay nature of working:
| Review Mail Flow & Message Trace | Check SMTP Logs | Validate TLS Encryption |
|---|---|---|
| Message has been submitted successfully | Successful TLS negotiation | TLS handshake is completed |
| Connector used | Successful connection | Trusted Certificate |
| Delivery status | No authentication error | No certificate mismatch |
| Total processing time | Accepted recipient | Encryption is enabled |
Note: Anyhow, if TLS fails, Exchange Online may reject the connection request as per your connector configuration. Some error messages you may get:
- 550 5.7.64 Relay Access Denied
- 454 TLS Not Available
- 535 Authentication Failed
- 451 Temporary Server Error
- 550 Sender Rejected
- Connection Timeout
Microsoft 365 SMTP Relay Best Practices
Just creating a connector in Exchange Online is not enough. For a secure and reliable Microsoft 365 SMTP relay deployment, some more effort is needed. Here are some:
- Prefer to use certificate-based authentication whenever possible.
- Limit your connector to specific sender domains, trusted certificates, and known public IP addresses.
- Avoid broad configurations to minimize unnecessary traffic.
- Monitor mail flow on a regular basis.
- Rotate or renew certificates before they expire.
- Review Office 365 SMTP connector configuration periodically.
Protect Microsoft 365 Data with Regular Backups
The SMTP relay configuration to Office 365 is important for email delivery, but the risk of data loss is still there. Accidental deletion, ransomware, retention policy changes, or user errors can create a severe hazardous situation in business workflows. So, do implement a foolproof backup strategy for Exchange Online mailboxes, contacts, calendars, etc.
For an effective, scheduled and automated backup solution, consider the Kernel Office 365 Backup tool. It creates secure backups in local files (PST, PDF, DOC, etc.) and simplifies recovery when needed. A proactive backup strategy complements your SMTP relay configuration so that your mail delivery and data protection stay in your control.
Final Wrap Up
Now you’re familiar with how to set up Microsoft 365 SMTP relay with TLS connect. You can opt for any method, either Exchange Admin Center or Exchange Online PowerShell, at your convenience to establish reliable mail flow across your organization.
Monitor message traces periodically, renew TLS certificates before they expire, review connector configurations, and keep an eye on Microsoft’s recommended security practices. With proper planning and maintenance & backup strategy, your Microsoft 365 SMTP relay connector can support business-critical email communication along with complete data protection.
