Microsoft 365 gives you more than one way to send email from an application, a printer or a server, and the names used for them are confusing: SMTP client submission, SMTP AUTH, direct send, SMTP relay with a connector. Each has a different server name, a different port, a different authentication method and different limits, and choosing the wrong one produces errors that look alike. This guide explains the three main options in Microsoft 365 and Exchange Online, what each one is good for, how to set up the connector-based relay, the limits that apply, why the status of basic authentication matters, common error messages and when it is time to move customer-facing mail to a dedicated sending service. Microsoft changes these features regularly, so confirm details in Microsoft's current documentation before you commit to a design.
The three ways to send from Microsoft 365
| Option | Server | Port | Authentication | Can send to external recipients? |
|---|---|---|---|---|
| SMTP client submission (SMTP AUTH) | smtp.office365.com | 587 with STARTTLS | A licensed mailbox username and password or supported modern method | Yes, subject to per-mailbox limits |
| Direct send | Your domain's Microsoft 365 mail endpoint, in the form yourdomain-com.mail.protection.outlook.com | 25 | None; messages are sent unauthenticated from your IP address | No; only to recipients in your own Microsoft 365 organisation |
| SMTP relay with a connector | The same mail endpoint as direct send | 25 | A connector that trusts your public IP address or certificate | Yes |
The server name for client submission is well known. The mail endpoint for direct send and relay is shown in the Microsoft 365 admin center under the DNS records for your domain, as the MX record target, so copy it from there.
Option 1: SMTP client submission
With client submission, the application signs in to one real mailbox and sends through it, just as Outlook does. It is the simplest option and works from anywhere on the internet, as long as outbound port 587 is open. Details of the settings are in Outlook and Microsoft 365 SMTP settings.
What to know
- It needs a licensed mailbox, so each sending identity costs a licence unless you use a shared or service mailbox set up for the purpose.
- SMTP AUTH can be switched off. Microsoft has been moving away from basic authentication, which is the plain username and password method, and administrators may disable SMTP AUTH for the organisation or for specific mailboxes. If your application fails with an authentication error, check that SMTP AUTH is enabled for that mailbox and that your authentication method is still supported. Microsoft's roadmap for this changes, so read the current notices.
- Per-mailbox limits apply. Microsoft publishes limits on messages per minute and recipients per day for each mailbox. At the time of writing, the figures are modest, designed for people, not for bulk mail. Look up the current numbers.
- The sender address is normally restricted to the mailbox you sign in with, or an address it has permission to send as.
Option 2: Direct send
Direct send lets a device or application deliver mail straight to your Microsoft 365 mail endpoint on port 25, without logging in. It suits printers and scanners that send to staff inside your company. Because the mail is unauthenticated, Microsoft accepts it only for your own organisation's recipients. Your sending IP address should be included in your domain's SPF record, since the message uses your domain as the sender. The limits are that it cannot reach external recipients, port 25 outbound must be open from your network, and the unauthenticated nature means that messages may be treated as less trusted. It is the right choice for internal alerts, and the wrong choice for anything customers see.
Option 3: SMTP relay with a connector
An SMTP relay connector lets trusted servers send to anyone, including external recipients, through the same mail endpoint, without per-mailbox credentials. Microsoft identifies your server by its public IP address or by a TLS certificate. This is the usual choice for on-premises line-of-business servers, multifunction devices that must email customers and applications that cannot authenticate.
How to set it up
- Gather your details: the static public IP address of the sending server or network, or a certificate whose subject matches the connector.
- Open the Exchange admin center and go to mail flow and connectors. Create a new connector.
- Select the direction: from "Your organisation's email server" to "Microsoft 365".
- Name the connector clearly, such as "Application relay".
- Choose how Microsoft identifies your server: by the sender's IP address, or by a certificate.
- Enter the IP addresses exactly, review the summary and create the connector.
- Update the SPF record for your domain to include the sending IP address if it is not already covered.
- Configure the sender: host set to your domain's mail endpoint, port 25, TLS if supported and no authentication.
- Test by sending a message to an external address, and inspect the headers for authentication results.
Outbound port 25 is blocked by many cloud and hosting providers, so confirm that your server can reach the endpoint. A quick connection test is described in how to test an SMTP connection.
Common errors
| Error or symptom | Likely cause | Fix |
|---|---|---|
| Authentication unsuccessful | SMTP AUTH disabled, wrong password, multi-factor authentication on the account or basic authentication no longer accepted | Enable SMTP AUTH for the mailbox or switch to a supported method |
| Client does not have permissions to send as this sender | The from address differs from the signed-in mailbox | Send as the mailbox or grant Send As permission |
| Relay access denied | The connector does not recognise the sending IP address | Check the public IP and that the connector is active |
| Recipient address rejected: access denied (direct send) | Sending to an external address without a connector | Create a connector or use client submission |
| Mail goes to spam | SPF does not include the sender, or DKIM and DMARC are not set | Fix authentication; check with the SPF, DKIM and DMARC checker |
| Throttling or temporary rejection | Mailbox or tenant limits reached | Reduce the rate, spread the load or use a dedicated service |
For help reading rejection codes, see SMTP bounce codes explained.
Keep authentication in order
Whichever option you choose, mail sent as your domain must pass SPF, DKIM and DMARC. If several services send on behalf of the domain, make sure the records cover all of them and that there is only one SPF record. See managing multiple email vendors on one domain and the guide to the SPF lookup limit.
When Microsoft 365 is the wrong tool
Microsoft 365 is built for the mail that people and business systems send inside normal volumes. If you need to send order confirmations, password resets and notifications to customers, or campaigns to a list, a sending service is a better fit: it offers dedicated reputation management, automatic handling of bounces and complaints, event webhooks, templates and logs, and it keeps customer mail from affecting the mailboxes your staff depend on. Read SMTP relay explained and separating transactional and marketing streams for the design principles.
Send customer email without tenant limits Use an SMTP relay or API built for application mail, with bounce handling and event reporting.
References and further reading
Frequently asked questions
What are the options for SMTP relay in Microsoft 365?
SMTP client submission through smtp.office365.com on port 587, direct send to your own organisation's mailboxes on port 25, and connector-based relay on port 25 that can reach external recipients.
Can direct send reach external recipients?
No. Direct send delivers unauthenticated mail only to recipients in your own Microsoft 365 organisation. Use a connector or client submission for external mail.
Why does SMTP AUTH fail in Microsoft 365?
SMTP AUTH may be disabled for the mailbox or organisation, the password or multi-factor setup may block the sign-in, or basic authentication may no longer be accepted. Check the mailbox setting and Microsoft's current notices.
How do I set up a connector for SMTP relay?
In the Exchange admin center create a connector from your organisation's email server to Microsoft 365, identify the server by IP address or certificate, then send to your domain's mail endpoint on port 25.
Is Microsoft 365 suitable for bulk or marketing email?
No. It has sending limits designed for normal business use. Use a sending service for customer-facing and marketing mail.