Description

Secure email delivery from existing systems through Microsoft 365

Many applications, server services and on-premises mail servers can send email reliably via SMTP but do not support modern OAuth2 authentication with Microsoft 365.

VivaTec SMTP Relay bridges this gap.

The application accepts email from your local network via SMTP and securely forwards it through Microsoft 365 / Exchange Online. It authenticates using OAuth2 / XOAUTH2 and a certificate rather than a permanently stored user password.

This lets you continue using existing systems without requiring them to support OAuth2.

Ideal for on-premises Microsoft Exchange servers

An on-premises Microsoft Exchange server can also use VivaTec SMTP Relay as a smart host.

Exchange Server supports modern authentication in various client and hybrid scenarios. However, a traditional Send Connector using a smart host does not provide OAuth2 / XOAUTH2 authentication to that smart host.

VivaTec SMTP Relay handles modern authentication on its behalf and securely forwards messages through Exchange Online.

Typical mail flow:

On-premises Microsoft Exchange server
→ SMTP / SmartHost
→ VivaTec SMTP Relay
→ STARTTLS + OAuth2 / XOAUTH2
→ Microsoft 365 / Exchange Online

Typical use cases

• on-premises Microsoft Exchange servers using smart host delivery
• HCL Domino and HCL Verse
• inventory management and ERP systems
• document management and archiving systems
• multifunction printers and scanners
• legacy server applications
• custom business applications
• devices and services that only support traditional SMTP

Modern Microsoft 365 authentication

The sending system does not need to support OAuth2 or Microsoft Entra authentication itself.

VivaTec SMTP Relay handles modern authentication with Microsoft 365 using STARTTLS and XOAUTH2.

Certificate-based authentication instead of a user password

VivaTec SMTP Relay connects to Microsoft 365 using a Microsoft Entra application and a locally stored certificate.

Ongoing SMTP delivery therefore does not require a permanently stored user password.

The private key remains in the server’s Windows certificate store and does not need to be stored in a configuration file.

Targeted Exchange permissions

Exchange Online Application RBAC lets you specify which mailboxes the relay is permitted to send messages from.

This restricts the application to the sender mailboxes it actually needs.

No open SMTP relay

Access to the local SMTP service can be restricted as required.

You can define restrictions including:

• permitted source IP addresses
• permitted senders
• permitted sender domains
• mappings between local senders and Microsoft 365 mailboxes

VivaTec SMTP Relay can therefore serve multiple internal systems centrally without operating as an open relay.

Local mail queue for reliable delivery

Incoming messages are stored locally before they are forwarded.

If Microsoft 365 is temporarily unavailable, messages are retained and delivery is retried automatically.

Supported features include:

• persistent local queue
• automatic retries
• error logging
• resuming delivery after a server or service restart

Guided Microsoft 365 setup

Setting up Microsoft Entra and Exchange Online normally requires several administrative steps.

The built-in VivaTec SMTP Relay setup wizard helps with:

• Microsoft 365 administrator sign-in
• Microsoft 365 tenant detection
• creating or selecting the Entra application
• creating and assigning a certificate
• Exchange service principal
• Exchange RBAC permissions
• managing permitted sender mailboxes
• OAuth2 test
• XOAUTH2 SMTP test
• applying the required settings to the relay configuration

Runs as a Windows service

VivaTec SMTP Relay is designed for continuous operation in Windows Server environments.

The relay runs in the background as a Windows service. A separate graphical configuration application lets you manage settings, the Microsoft 365 connection and diagnostics.

Benefits at a glance

• continue using your existing SMTP systems
• suitable for on-premises Microsoft Exchange servers
• OAuth2 / XOAUTH2 connection to Microsoft 365
• no permanently stored SMTP user password required
• certificate-based authentication
• fine-grained Exchange permissions
• persistent local mail queue
• automatic retries
• IP address and sender restrictions
• guided Microsoft 365 setup
• Runs as a Windows service
• centralised configuration and diagnostics

VivaTec SMTP Relay connects existing SMTP infrastructure to modern Microsoft 365 authentication without requiring the sending applications or mail servers to support OAuth2 themselves.

For help with setup and operation, please get in touch via our Contact.