SMTP_RELAYS Office365 / Exchange Online

[LickABrick]

Hi, we want to forward/relay our messages through Exchange Online (Office365). We have configured:

smtp_relays: ['smtp://example.com.mail.protection.outlook.com:25']

When I send a mail I get the error:

550 5.7.64 TenantAttribution; Relay Access Denied [ValidationStatus of '' is EmptyCertificate] [DB1PEPF000509F5.eurprd02.prod.outlook.com 2024-10-04T14:43:44.980Z 08DCE03274E0E56F]

We have correctly added the outbound WAN IP of the Postal server to the M365 Connector (and we know it works as some other devices on the same WAN use it aswell).

Does anyone know how to fix this?

[willpower232]

I believe that Microsoft relatively recently started requiring unique certificates per connector so if this approach worked before, they're trying extra hard now. I'm not sure if you can get away with configuring the SMTP certificate as normal or if it would have to be a special certificate that would break normal usage.

Did you configure Postal SMTP with a certificate for STARTTLS?

[LickABrick]

Hi, thanks for the quick response. The connector is IP based so it should not do anything with certificates:

[willpower232]

Well judging by the error message, it is apparently still looking for a certificate, regardless of verification 😅

[LickABrick]

I have changed smtp_relays: ['smtp://example.com.mail.protection.outlook.com:25'] to smtp_relays: ['smtp://example.com.mail.protection.outlook.com:25?ssl_mode=TLS'] (ssl_mode is quite sparsely documented btw, only knew of it because of another issue/discussion) and now I receive the error: SSL_connect returned=1 errno=0 peeraddr=<ip of exchange online>:25 state=error: wrong version number

I have tried defining the tls_ciphers=TLSv1_3 but this does not change anything.

Btw this is a newly created server, we used an SMTP relay via a Windows IIS server before which worked fine but is constrained in functionality/configurability. I am 100% sure the IP based connector is functioning from the network the Postal server is located in.

[LeftoversTodayAppAdmin]

+1 Same issue, I tried using ssl_mode=STARTLS and now it says client is not authorized, so there is no way to pass in SMTP relay authentication.