SMTP relay for Microsoft 365. Old devices keep sending.
SMTPly accepts email via plain SMTP on your Windows server and delivers it through Microsoft Graph with OAuth2. Printers, scanners, ERP systems and alarm panels need no update and no OAuth2.
Trusted by
Basic Auth is ending. Your devices aren’t.
Microsoft is retiring username and password sign-in for SMTP in Exchange Online. At the end of December 2026 it will be switched off by default in existing tenants, and new tenants won’t get it at all. Administrators can turn it back on for now, but Microsoft plans to announce the final removal date in the second half of 2027. Devices that only know SMTP with a password will then get an error instead of a delivery.
Third-floor scanner, straight to Microsoft 365
From 2027- Server
- smtp.office365.com:587
- Sign-in
- scanner@example.com + password
- Method
- Basic Auth
535 5.7.139 Authentication unsuccessful, basic authentication is disabled.
Same scanner, via SMTPly
With SMTPly- Server
- smtply.company.local:25
- Sign-in
- none, or one account per device
- On to M365
- OAuth2 via Microsoft Graph
250 OK · handed to Microsoft 365, delivered
Nothing changes in the firmware. Only the server address in the device now points to SMTPly instead of straight to Microsoft.
The shutdown timeline in detail →Replacing IIS SMTP and hMailServer →
Set up in three steps.
A wizard takes you from first launch to a real test email. It usually takes less than ten minutes.
Install on the server
One signed installer, no extra runtime needed. SMTPly then runs as a Windows service, even when nobody is signed in.
Connect Microsoft 365
Sign in once with an admin account and consent. SMTPly creates the app registration itself, no Azure portal and no PowerShell.
- Read and write applications
- Manage app permission grants
- View your basic profile
Repoint your devices
Just change the SMTP server in the printer, ERP or monitoring tool. No new firmware, no OAuth2, no password on the device.
Prefer to do it by hand? The Entra admin center route is described step by step in the guide.
A relay you never have to chase.
It runs quietly in the background. And if something does get stuck, you see where in seconds.
Every email traceable.
The Maillog shows live what passes through: who sent it, to whom, from which device, and whether Microsoft 365 accepted it.
- Search and filter across all columns
- Expandable details: source IP, user, transport, Graph ID, error message
- Automatic retry if Microsoft 365 is briefly unreachable
- Entries can be masked afterwards
- Dashboard with figures, trend chart and rankings: top senders, recipients, source IPs and rejection reasons
- Mailflow with ruleset, counter per rule and rule tester: “What happens to this mail?”
| Date/time | From | To | Subject | Source IP | Transport |
|---|
| Rule | Conditions | Action | State | Counter | |
|---|---|---|---|---|---|
| Reception4 | |||||
| Requirements (all must be met) | 4.318 | ||||
| 6 | Allowed source IPs | Source in: 192.168.10.0/24 ✎ | Required | active | 12 |
| 11 | Message size | at most 25 MB ✎ | Required | active | 0 |
| 12 | Everything else | – | Reject (550) | always | |
| Assignment3 | |||||
| 13 | Tenant example.com | Sender in: @example.com ✎ | Assign: example.com | active | 4.318 |
| 15 | No tenant matches | – | Reject (550) | always | 7 |
| Delivery1 | |||||
| 23 | All assigned mails | – | Hand over to Microsoft 365 | always | 4.316 |
Secure, even when the device is old.
You decide which devices may send. Encryption goes as far as the device can handle.
- STARTTLS and implicit TLS, certificate from the Windows certificate store as well
- Renewed certificates take effect without a service restart
- Allow by source IP or network, IPv4 and IPv6
- Optional SMTP authentication with one account per device Business
Certificate
One certificate for all services on this machine. Changes apply without restarting the service.
Certificate source
Subject or thumbprint
Using the subject, SMTPly also finds the renewed certificate from your internal CA.
Self-test instead of guesswork.
One click checks the service, ports, certificate, TLS handshake and the connection to Microsoft. For support there is a diagnostics bundle that never includes passwords or keys.
Help & support
Logs, masked mail overview and configuration. Passwords, client secrets and license keys are never included.
Create diagnostics bundle …Multiple tenants Business
Up to 5 (Business) or 25 (Enterprise) Microsoft 365 tenants, routed by sender domain or device account.
Journal-BCC Business
Blind copy to an archive mailbox, optionally only for certain senders.
Rate limit per device Business
A printer stuck in a loop only slows itself down, not the whole tenant.
Webhooks Business
Delivery failures and events straight to Teams, Slack or your ticket system.
Sandbox mode Enterprise
Before switching over, send every mail to a test mailbox instead of real recipients.
Outbound rules Enterprise
Choose tenant, sender and journaling per mail. A rule never changes the content.
REST & MCP Enterprise
Status and history as JSON or for an AI assistant, read-only.
Syslog & audit trail Enterprise
Forwarding to your SIEM and a checksum chain over the mail history.
Automatic retry
If Microsoft 365 is briefly unreachable, the mail waits in a queue on disk and is delivered later. Mail already accepted also survives a restart.
Usage reports
Daily, weekly or monthly by email: mails sent, error rate, top senders.
Expiry warnings
Reminder 30, 14 and 7 days before the client secret or certificate expires.
Backup
Export the configuration encrypted and restore it on a new server. From Business, optionally on a regular automatic schedule.
For the devices nobody wants to touch again.
Wherever an application sends email but will never learn OAuth2.
Printers & scanners
Scan-to-email from multifunction devices whose firmware stopped getting updates long ago.
ERP & inventory
Invoices, delivery notes and reminders straight from the system, with attachments, unchanged. A copy lands in the sender mailbox’s Sent Items.
Monitoring & alarms
PRTG, Zabbix, UPS, fire and intrusion alarms. Messages that have to arrive.
Hotel & industry software
Booking confirmations, receipts and appointment reminders from specialist apps.
Backup, NAS & servers
Status reports from backup software, NAS and hypervisors.
Industrial equipment & controls
PLCs, machines, air conditioning, refrigeration units and building systems whose fault alerts someone has to read.
Network hardware
Firewalls, switches, Wi-Fi controllers and phone systems with email alerts.
CRM & web shop
Quotes, order confirmations and customer emails from apps without OAuth2.
Scripts & legacy apps
PowerShell, scheduled tasks and web apps that send via SMTP.
Your email stays your email.
SMTPly runs entirely on your server. There is no other server between your device and your Microsoft 365, including none of ours.
- Passed on byte for byte: attachments, encoding and signatures stay untouched
- No telemetry, no usage data, no phoning home
- Credentials encrypted with Windows DPAPI
- No data processing agreement with us needed, we never see any data
- Ready for NIS2 and the Cyber Resilience Act: vulnerability contact and a software bill of materials (SBOM) for every version
That’s why SMTPly also fits where privacy is non-negotiable: healthcare, law firms and public authorities.
What administrators say.
“Without SMTPly, moving from on-premises Exchange to Office 365 would have meant reconfiguring more than 1,000 devices. After a short test it went straight into production: around 300 mails a day, without touching a single backup tool, firewall or printer.”
Translated from German
“The app really makes our daily work a lot easier, and I’m sure it will help many other administrators. Plus the great and fast support.”
Translated from German
“Thanks to SMTPly we connected our printers and technical equipment to Microsoft 365 in no time. Fault and status notifications now reach the responsible staff directly and reliably.”
Translated from German
Buy once. No subscription.
One license per server, yours to keep. Try every edition free for 14 days with all features.
Starter
- SMTP listener and OAuth2 relay
- STARTTLS and implicit TLS
- IP and sender allow lists
- Mail tracker with masking
- Wizard, self-test, diagnostics bundle
Business
- Everything in Starter
- SMTP auth per device, CSV import
- Multiple listeners, rate limit per source IP
- Webhooks, monitoring, journal BCC
- Scheduled backup, secret renewal
Enterprise
- Everything in Business
- REST API and MCP server
- Sandbox mode for migrations
- Outbound rules, Syslog/SIEM
- Retention beyond 14 days with audit trail
Today's prices apply until 31 October 2026. Existing licenses are not affected by the price change.
If you are interested in a partnership, or would like to offer SMTPly as a reseller or MSP partner, please get in touch. Get in touch
Pay securely through Polar as merchant of record. Your license key arrives by email, updates are free. Download the trial
Frequently asked questions.
Does my email pass through your servers?
No. SMTPly runs only on your Windows server. From there, mail goes straight to Microsoft Graph, into your existing Microsoft 365 environment. We never see your email.
Do I need to change anything on my devices?
Only the SMTP server address. Instead of smtp.office365.com you enter the name or IP of your SMTPly server. Firmware, sign-in method and sender stay as they are.
Which Windows versions does SMTPly run on?
Windows Server 2016, 2019, 2022 and 2025, plus Windows 10 and 11. The runtime is included in the installer, nothing else to install.
What happens if Microsoft 365 is briefly unreachable?
The mail waits in a protected queue on your server, readable only by the service and administrators, and is delivered automatically once it can be. A server restart doesn’t touch the queue either.
What happens after the 14-day trial?
During the trial everything is unlocked, with no mail limit. After that, delivery pauses until a license is activated: devices receive a temporary rejection and retry later, queued mail is kept. Configuration and logs are kept as well. SMTPly sends a reminder by email three days and one day before.
Can I move the license to a new server?
Yes. Release the license in the app and activate the same key on the new server.
Ready before Microsoft switches off?
Download the trial, install, connect Microsoft 365. Most people are done in ten minutes.