---
title: "Create TLS and Non-TLS Office 365 SMTP Relays"
description: "Build and test TLS and non-TLS Office 365 SMTP relays using various techniques."
canonical: "https://adamtheautomator.com/office-365-smtp-relay/"
---

# Create TLS and Non-TLS Office 365 SMTP Relays

> Build and test TLS and non-TLS Office 365 SMTP relays using various techniques.

Source: https://adamtheautomator.com/office-365-smtp-relay/

---

ATA Learning

Tap to hide

[

ATA Learning

](/)

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Search for:  

*   [](https://twitter.com/adbertram)
*   [](https://github.com/Adam-the-Automator)
*   [](https://www.linkedin.com/company/adam-the-automator-llc)
*   [](/feed/)

![Create TLS and Non-TLS Office 365 SMTP Relays](https://adamtheautomator.com/wp-content/uploads/2019/09/office-365.jpg)

# Create TLS and Non-TLS Office 365 SMTP Relays

[![](https://secure.gravatar.com/avatar/9a14f10ff1b1ec7d790d34f5b559e4d3de2d31b172e6ef266dfd8b479174d97b?s=192&d=mm&r=g)June Castillote](https://adamtheautomator.com/author/june/)11 September 20198 min. read

Categories: [Cloud](/category/cloud/)

Tags:[Office 365](/tag/office-365/)

Table of Contents

*   [Prerequisites](#prerequisites)
*   [Create a Non-TLS Connector using the Exchange Admin Center](#create-a-non-tls-connector-using-the-exchange-admin-center)
*   [Create a TLS Connector using Exchange Admin Center](#create-a-tls-connector-using-exchange-admin-center)
*   [Create a Non-TLS Connector using PowerShell](#create-a-non-tls-connector-using-powershell)
*   [Create a TLS Connector using PowerShell](#create-a-tls-connector-using-powershell)
*   [Testing the Office 365 SMTP Relay Connector with PowerShell](#testing-the-office-365-smtp-relay-connector-with-powershell)
*   [Testing a non-TLS SMTP Relay (IP Address)](#testing-a-non-tls-smtp-relay-ip-address-)
*   [Testing a TLS SMTP Relay (Certificate)](#testing-a-tls-smtp-relay-certificate-)
*   [Validating SMTP Relay Hops using the Message Header](#validating-smtp-relay-hops-using-the-message-header)
*   [Summary](#summary)
*   [Further Reading](#further-reading)

Hate it or love it; email is everywhere. The protocol to move that email everywhere is SMTP, and the SMTP “routers” are [SMTP relays](https://www.google.com/url?q=https://blog.mailchannels.com/what-is-an-smtp-relay-service&sa=D&ust=1567614949948000).

Not a reader? Check out this tutorial’s related video.

**_Not seeing the video? Make sure your ad blocker is disabled._**

Setting up SMTP relays varies across systems, but if you have Office 365 as your mail service provider, your options are limited. Setup can be complicated and error-prone, especially for devices that are not [TLS](https://www.google.com/url?q=https://www.internetsociety.org/resources/ota/2017/transport-layered-security-tls-for-email/&sa=D&ust=1567614949948000) capable.

> _Note that sending email through Office 365 does not require an SMTP relay. You can have clients send emails directly to Office 365 without adding an SMTP relay that does not require any configuration changes. To learn what they are, read [How to Send Office 365 Direct Send/SMTP Client Submission Email (PowerShell)](https://adamtheautomator.com/office-365-direct-send/)._

## Prerequisites

These are the requirements before you can proceed.

1.  An Office 365 Subscription. If you do not have this yet, you can [Sign up for an Office 365 E5 trial subscription](https://www.google.com/url?q=https://aka.ms/e5trial&sa=D&ust=1567614949950000).
2.  A Windows 10 computer with PowerShell v5.1
3.  A [public static IP address](https://www.whatismyip.com/). You can still create an SMTP relay in Office 365 even without this, but you might not test.
4.  TCP port 25 access from a client to your Office MX endpoint
5.  A valid SSL certificate. This certificate could be a wildcard certificate (eg. _\*.yourdomain.com_) issued by third-party certificate authorities like LetsEncrypt, Digicert, etc. Note, that you cannot use self-signed certificates or certificates issued by an internal PKI because they are not supported. (_only required for TLS connections_)

To set up an SMTP relay, you must first create a connector in Office 365 to accept SMTP transactions. This connector will receive SMTP relay transactions from the application or device.

Before you attempt to create a connector, be sure your account has the proper [Exchange Online permissions](https://www.google.com/url?q=https://docs.microsoft.com/en-us/exchange/permissions-exo/permissions-exo&sa=D&ust=1567614949952000). Ensure your account is a member of the _Organization Management_ group.

There are two ways to create a connector. You can either use the _Exchange Admin Center_ or PowerShell. Both options will perform the same task. It’s up to you which one to use. In this article, we’ll cover both. We’ll also cover creating both non-TLS and TLS connectors.

## Create a Non-TLS Connector using the Exchange Admin Center

Let’s start by creating a non-TLS connector. You’ll first learn how to do this via the [_Exchange Admin Center_](https://outlook.office365.com/ecp). You can configure many Office 365 SMTP settings in the Exchange Admin Center.

Once logged in, click on _mail flow_ **(1)** –> _connectors_ **(2)** –> _New_ **(3)**. The _New Connector_ window will pop-up.

![New Connector](/wp-content/uploads/2019/09/jfvYO6R.png)

New Connector

In the _New Connector_ window, select _From: Your organization’s email server_ **(1)**, select _To: Office 365_ **(2)**, click _Next_ **(3).**

![Selecting a mail flow scenario](/wp-content/uploads/2019/09/3oiTxih.png)

Selecting a mail flow scenario

In the next window, enter the name _SMTP Relay (Non-TLS)_ or choose your own name **(1)**, type in the description _Accept relay from on-premises SMTP Server_ **(2)**, uncheck _Retain internal Exchange email headers (recommended)_ **(3)** and click _Next_ **(4).**

![Assigning a name to the connector](/wp-content/uploads/2019/09/WCboLxB.png)

Assigning a name to the connector

In the next window, select _By verifying that the IP address of the sending server matches one of these IP addresses that belong to your organization_ **(1)**, and click _Add_ **(2).**

![Adding allowed IP adresses to the connector](/wp-content/uploads/2019/09/N9WQf7C.png)

Adding allowed IP adresses to the connector

In the new pop-up window, type in your public IP address **(1)**, then click _OK_ **(2)**. This should bring you back to the previous window.

![Adding allowed IP adresses to the connector](/wp-content/uploads/2019/09/TDwBJkJ.png)

Adding allowed IP adresses to the connector

Verify that the IP address is added in the list **(1)**, then click _Next_ **(2)**.

![Adding allowed IP adresses to the connector](/wp-content/uploads/2019/09/evUUItY.png)

Adding allowed IP adresses to the connector

Then you will see the summary of the changes that you need to implement. Work on the necessary changes first. If there’s none, you can go ahead and click _Save_.

Back in the _Exchange Admin Center_, you can now confirm that the new connector has been created.

![Office 365 Connector has been created](/wp-content/uploads/2019/09/pHp8hOf.png)

Office 365 Connector has been created

You should now have a non-TLS connector created.

## Create a TLS Connector using Exchange Admin Center

Creating a TLS connector is similar to creating a non-TLS connector. Like how you created a non-TLS connector, head back to the _New Connector_ wizard and use the same mail flow scenario. I’ll be using a a connector name of _SMTP Relay (Non-TLS)_ but yours may vary.

In the window to define Office 365 should identify email from your email server, select_:_

*   _By verifying that the subject name on the certificate that the sending server uses to authenticate with Office 365 matches this domain name (recommended)_ **(1)**
*   then type in the subject of the SSL certificate **(2)**
*   and click Next **(3)**.

![Create a TLS Connector using Exchange Admin Center](/wp-content/uploads/2019/09/a7nXZiF.png)

Create a TLS Connector using Exchange Admin Center

Again, you will see a summary of necessary changes. Work on them first before processing. If there’s none, you can click the _Save_ button right away.

## Create a Non-TLS Connector using PowerShell

If creating Office 365 connectors via a GUI isn’t your thing, you can always [create them via PowerShell](https://adamtheautomator.com/teams-webhooks/) as well. To do so, first ensure you are connected to Exchange Online PowerShell.

To create the connector, you’ll need to run the `New-InboundConnector` command. This command requires a few different parameters so I’ll set up these parameters ahead of time using PowerShell [splatting](https://www.google.com/url?q=https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_splatting?view%3Dpowershell-6&sa=D&ust=1567614949960000).

I’ve added some comments in the code itself below but here’s a breakdown of each parameter and what it’s used for:

*   **Name** – This is the name of the connector.
*   **ConnectorType** – This is the type of connector. This value can be `OnPremises` or `Partner`. In this scenario, the appropriate type is `OnPremises`.
*   **SenderDomains** – This can be a list of the allowed sender domains. Only verified domains for your tenant are valid choices. The asterisk ( `*`) means that you are allowing all of your verified domains to relay messages using this connector. If you only need to allow certain sender domains, change this value to an array of the domains. (eg. `'domain1.com','domain2.com'`)
*   **SenderIPAddresses** – This is your public IP address. Do not forget to change this before execution.
*   **RestrictDomainsToIPAddresses** – When this value is set to `$true`, it indicates that this connector will only accept emails from sender addresses coming from your allowed public IP address.

```powershell
$splat = @{
    ## Define the name of the connector.
    Name = 'SMTP Relay'
    ## Defined the type of connector to create.
    ConnectorType = 'OnPremises'
    ## The set of sender domains allowed to relay.
    SenderDomains = '*'
    ## Change this to your actual public IP address.
    SenderIPAddresses = '110.x.x.x'
    ## Restrict the email relay only to your sender domains and sender IP address
    RestrictDomainsToIPAddresses = $true
}

## Create the connector
New-InboundConnector @splat
```

When executed, you should see something similar to below.

![New-InboundConnector](/wp-content/uploads/2019/09/v9f2Zby.png)

New-InboundConnector

## Create a TLS Connector using PowerShell

Assuming you’re [connected](https://www.google.com/url?q=https://docs.microsoft.com/en-us/powershell/exchange/exchange-online/connect-to-exchange-online-powershell/connect-to-exchange-online-powershell?view%3Dexchange-ps&sa=D&ust=1567614949962000), run the code below to create a TLS connector with PowerShell as well. You can see below many parameters are identical to creating a non-TLS connector.  The required parameters that differ from creating a non-TLS connector are:

*   **RequireTLS** – This specifies that all messages received by this connector require TLS transmission
*   **TlsSenderCertificateName** – This is the name (or subject) of the certificate used by the sender.

```powershell
$splat = @{
    ## Define the name of the connector.
    Name = 'SMTP Relay (TLS)'
    ## The type of connector to create.
    ConnectorType = 'OnPremises'
    ## The set of sender domains allowed to relay.
    SenderDomains = '*'
    ## Require TLS
    RequireTLS = $true
    ## Subject/Name of the SSL certificate
    TlsSenderCertificateName = '*.YourDomain.com'
}

## Create the connector
New-InboundConnector @splat
```

Execute the above code and to have a TLS connector created and ready to receive email.

## Testing the Office 365 SMTP Relay Connector with PowerShell

After creating the connector, prepare to test it out. The easiest way to do that is to use PowerShell. In this section, we’ll create some PowerShell scripts to allow you to easily ensure the connector is working properly.

> _Before you get started testing, first ensure you know what the MX endpoint URL is for your Exchange Online domain. If you don’t know how to find your MX endpoint URL, log in to the [Office 365 Admin Portal](https://portal.office.com/adminportal\)). Click on Setup, select Domains, click the Domain name and copy the MX Points to address or value._

### Testing a non-TLS SMTP Relay (IP Address)

> _Note: This testing must be done from the computer whose public IP address is allowed in the Office 365 SMTP relay setup._

Use the PowerShell code below for testing. Be sure to change the `From`, `To` and `SmtpServer` parameter values to use your own Office 365 SMTP relay settings before running it.

*   `To` – Must include one internal domain recipient and one external domain recipient. Don’t forget to change these values to your own.
*   `From` – Must be changed to your nominated sender address. The domain part of the email address must be one of your tenant’s email domains.
*   `SmtpServer` – Must be changed to your Office 365 tenant’s MX endpoint.

```powershell
$mailParams = @{
    SmtpServer = '<tenant>.mail.protection.outlook.com'
    Port = '25'
    From = 'sender@yourdomain.com'
    To = 'recipient@yourdomain.com','recipient@NotYourDomain.com'
    Subject = ('SMTP Relay - ' + (Get-Date -Format g))
    Body = 'This is a test email using SMTP Relay'
    DeliveryNotificationOption = 'OnFailure','OnSuccess'
}

Send-MailMessage @mailParams
```

### Testing a TLS SMTP Relay (Certificate)

> _Note: You must have the public SSL certificate in PFX format before you can proceed with this test._

Since the TLS SMTP relay requires a certificate, you cannot use the `Send-MailMessage` PowerShell cmdlet because it does not allow you to select a specific certificate. Instead, use two .NET objects called [System.Net.Mail.SmtpClient](https://learn.microsoft.com/en-us/dotnet/api/system.net.mail.smtpclient?view=netframework-4.8) to define the SMTP parameters, and [System.Net.Mail.MailMessage](https://learn.microsoft.com/en-us/dotnet/api/system.net.mail.mailmessage?view=netframework-4.8) to compose the message.

Below you will find a PowerShell code snippet you can use to test the TLS SMTP relay. Do not forget to change the `pfxFile`, `pfxPass`, `From`, `To` and `SmtpServer` values to use your Office 365 SMTP relay settings before running it.

```powershell
# specify the full path of your PFX certificate
$pfxFile = "C:\Certificate\cert.pfx"
$pfxPass = '<cert password here>'
$pfxBytes = Get-Content -path $pfxFile -encoding Byte -ErrorAction:SilentlyContinue
$X509Cert = New-Object -TypeName System.Security.Cryptography.X509Certificates.X509Certificate2
$X509Cert.Import([byte[]]$pfxBytes, $pfxPass,"Exportable,PersistKeySet")

# Build SMTP properties
$smtpServer = '<tenant>.mail.protection.outlook.com'
$smtpPort = '25'
$smtp = New-Object Net.Mail.SmtpClient($smtpServer,$smtpPort)
$smtp.ClientCertificates.Add($X509Cert)
$smtp.EnableSSL = $true

# Compose message
$emailMessage = New-Object System.Net.Mail.MailMessage
$emailMessage.From = 'sender@YourDomain.com'
$emailMessage.To.Add('recipient@YourDomain.com')
$emailMessage.To.Add('recipient@OtherDomain.com')
$emailMessage.Subject = ('SMTP Relay (TLS) - ' + (Get-Date -Format g))
$emailMessage.Body = 'This is a test email using SMTP Relay (TLS)'

# Send the message
$smtp.Send($emailMessage)
```

If set up the TLS connector is correct, the recipients define via the `Add()` method should receive the test email.

## Validating SMTP Relay Hops using the Message Header

Now you have a functional SMTP relay set up using a local server and Office 365 SMTP relay. All the tests were successful and your devices can send messages to both internal and external recipients. Nice job!

If you are still in doubt and need to confirm whether these messages are going through the Office 365 SMTP relay, you can review the message headers on the received emails.

> _Note: Opening the message headers are varies between different mail clients. The below example is specific to Gmail._

Open the email in Gmail interface, open the message, and click on the three vertical dots **(1)**, then click _Show original_ **(2)**.

![Validating SMTP Relay Hops using the Message Header](/wp-content/uploads/2019/09/lxWiRqJ.png)

Validating SMTP Relay Hops using the Message Header

A new page will show the email message headers. Click on _Copy to clipboard_ **(1)**.

![Validating SMTP Relay Hops using the Message Header](/wp-content/uploads/2019/09/bvNPoVR.png)

Validating SMTP Relay Hops using the Message Header

Open a new browser tab and navigate to [https://testconnectivity.microsoft.com/](https://www.google.com/url?q=https://testconnectivity.microsoft.com/&sa=D&ust=1567614949980000).

Go to the _Message Analyzer_ **(1)** tab, paste the copied data into the box **(2)**, and click _Analyze headers_ **(3)**.

![Analyzing headers](/wp-content/uploads/2019/09/oKqYx75.png)

Analyzing headers

The result of the analysis will be displayed in the table as shown below.

![Analyzing results](/wp-content/uploads/2019/09/cAoIh7S.png)

Analyzing results

You should see the following workflow in the results above:

1.  IP address 192.168.0.3 the indicates the origin of the computer.
2.  On-prem SMTP relay server received the message.
3.  Exchange Online Protection (EOP) received the message.
4.  Exchange Online server and re-routed for outbound delivery received the message.
5.  Office 365 to google.com delivered the message.

Based on the analysis results, you can confirm that the message did pass through the Office 365 SMTP relay as intended.

## Summary

In this article, you’ve learned how to create a TLS and non-TLS Office 365 SMTP relay. You also learned how to test and confirm their functionality using different techniques and how to validate the SMTP routes that the message had passed through.

## Further Reading

*   **_[Changes in message store and throttling for concurrent connections](https://learn.microsoft.com/en-us/exchange/troubleshoot/send-emails/smtp-submission-improvements)_**
*   **_[How To Create An SMTP Relay In Office 365 For Non-TLS devices (Video)](https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=2ahUKEwjV94XmyrfkAhUpwFkKHa8YCP4QFjABegQIChAK&url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3D0HCPhiclbSA&usg=AOvVaw3Stas46Bh9cVL22CsAEyKL)_**
*   **_[New-InboundConnector cmdlet reference](https://learn.microsoft.com/en-us/powershell/module/exchange/new-inboundconnector?view=exchange-ps)_**

Share this article

[Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Foffice-365-smtp-relay%2F&text=Create%20TLS%20and%20Non-TLS%20Office%20365%20SMTP%20Relays)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Foffice-365-smtp-relay%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Foffice-365-smtp-relay%2F)

## Related Posts

![](https://adamtheautomator.com/wp-content/uploads/2020/07/microsoft_office_logo_press_image_1200x800-100751542-large.jpg)

### [Connect Azure AD to Office 365: Install Azure AD Connect](/connect-azure-ad-to-office-365/)

Discover how to connect Azure AD to Office 365, install Azure AD Connect, and enable directory synchronization for your tenancy.

![](https://adamtheautomator.com/wp-content/uploads/2020/07/key-2114293_1280.jpg)

### [Enable MFA in Office 365: A Hands-On, Step-by-Step Guide](/office-365-mfa/)

Learn how to set up and enable multi-factor authentication (MFA) in Office 365 with this comprehensive, hands-on tutorial.

![](https://adamtheautomator.com/wp-content/uploads/2020/07/keyboard-155722_1280.jpg)

### [Delete Email from All Office 365 Mailboxes: Step-by-Step](/office-365-delete-email/)

Use Security and Compliance PowerShell cmdlets to search and delete email from all Office 365 mailboxes and prevent attacks.

## Categories

*   [IT Ops](/category/it-ops/)
*   [Cloud](/category/cloud/)
*   [DevOps](/category/devops/)
*   [Home Ops](/category/home-ops/)
*   [Information Security](/category/infosec/)
*   [Software Development](/category/software-development/)

## Site

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)