Email Relay Services: How SMTP Relays Work and How to Secure Them
How does a printer, website or invoicing app send email without a mailbox of its own? Through email relay services. An SMTP relay accepts mail from your devices and applications, checks they are allowed to send, then forwards the messages to recipients’ mail servers. Set up badly, the same relay lets spammers send as your domain.
What Are Email Relay Services?
Email relay services are SMTP servers that accept outgoing mail from your systems and pass it on to the recipient’s mail server. They give apps, websites, printers and on-premises servers an authenticated, reputable route to deliver email. A relay handles sending only. It does not store mail or give staff an inbox.
SMTP Relay vs a Mailbox (SMTP) Server
A mailbox server, such as Microsoft 365 or Google Workspace, hosts user inboxes and also sends their mail. An SMTP relay is a forwarding point for machines and software. Many businesses use both: staff mail through the mailbox service and app or device mail through a relay.
Public vs Private SMTP Relay Servers
A private relay accepts mail only from your authenticated systems. A public relay accepts mail from anyone, which is called an open relay and is a serious security failure. Commercial services such as Amazon SES, SendGrid and Mailgun are private relays shared by many customers, each authenticated separately.
How an SMTP Relay Works, Step by Step
This is the journey of one relayed message, in order.
- Connect. The app or device opens a connection to the relay on an agreed port.
- Encrypt. The connection upgrades to TLS, either straight away or with the STARTTLS command.
- Authenticate. The sender proves it is allowed to relay, by username and password, API key, OAuth token, certificate or approved IP address.
- Submit. The sender hands over the message and recipient addresses.
- Sign and check. The relay applies DKIM signing for your domain and checks rate limits and policies.
- Deliver. The relay looks up the recipient domain’s MX record and delivers the message over SMTP, ideally with TLS.
- Report. The relay logs the result and handles bounces.
The Simple Mail Transfer Protocol (SMTP) behind every step is defined in RFC 5321 (2008).
Authentication (SMTP AUTH, IP Allowlisting, Certificates)
SMTP AUTH uses credentials. IP allowlisting trusts mail from fixed addresses, such as your office’s public IP. Certificate-based connectors trust a sender that presents a specific TLS certificate. Use the strongest method each device supports, and never rely on IP alone where the address is shared.
Ports and Encryption: 587, 465, 25 and 2525
| Port | Use | Encryption |
|---|---|---|
| 587 | Mail submission from clients and apps (RFC 6409) | STARTTLS |
| 465 | Mail submission with implicit TLS (recommended by RFC 8314, 2018) | TLS from the first byte |
| 25 | Server-to-server delivery | STARTTLS when both sides support it |
| 2525 | Non-standard alternative some relay providers offer when 587 is blocked | Usually STARTTLS |
Use 587 or 465 for submission. Many networks and cloud platforms restrict outbound port 25. AWS, for example, limits it on EC2 instances by default.
When Does a Business Need an Email Relay Service?
Apps, Websites and Transactional Email
Order confirmations, password resets and alerts need a reliable route. A dedicated sending service keeps that mail apart from staff mail.
Printers and Scan-to-Email Devices
Multifunction printers often support only basic SMTP settings. That makes them a frequent reason to set up a relay.
On-Premises Exchange Smarthost
An on-premises or hybrid Exchange server can route outbound mail through a smart host (a relay) for filtering, reputation or routing control.
Microsoft 365 and Google Workspace Relay Options
SMTP AUTH Client Submission vs SMTP Relay Connector vs Direct Send
Microsoft 365 offers three routes:
- SMTP AUTH client submission: the device signs in with a mailbox account to smtp.office365.com on port 587. Microsoft’s January 2026 update says Basic authentication (username and password) for this route will be disabled by default at the end of December 2026, with a final removal date to be announced in the second half of 2027. Plan to move devices to OAuth or another route now.
- SMTP relay connector: a connector trusts your office’s static IP or certificate and relays to any recipient, with no mailbox license needed.
- Direct Send: devices send straight to your tenant’s MX endpoint, with no authentication, and can only reach internal recipients. Because it is unauthenticated, attackers can abuse it to spoof internal senders. Microsoft added a setting in 2025 to reject Direct Send, and tenants that do not use it should turn it on.
Google Workspace SMTP Relay Service
Google’s relay service (smtp-relay.gmail.com) lets admins allow devices by IP address or SMTP AUTH and require TLS. Restrict it to your own domains and to the specific addresses that need it.
Security Risks of SMTP Relays
Open Relays and Blocklisting
An open relay sends mail for anyone, so spammers can use it, and your IP address and domain can land on blocklists such as those run by Spamhaus. Then your normal mail stops reaching customers.
Stolen Relay Credentials and API Keys
Relay passwords and API keys often sit in plain text in printer settings, app config files or code repositories. Anyone who finds them can send authenticated mail as your domain, which passes SPF and DKIM.
Spoofing and Unencrypted Traffic
Unauthenticated routes, such as Direct Send or an internal relay that trusts any internal device, let attackers spoof senders. Relays that fall back to plain text expose message content and, with Basic auth, credentials.
How to Secure an SMTP Relay: Best Practices
Enforce Authentication and TLS
Require authentication for every sender, prefer OAuth or API keys over shared passwords, and require TLS on submission. Give each device or app its own credential so one leak can be revoked alone.
Restrict by IP, Domain and Rate Limits
Allow only the source IPs and sender domains you use, and set per-sender rate limits. A printer has no reason to send 5,000 messages an hour.
Align SPF, DKIM and DMARC for Relayed Mail
Add the relay to your SPF record, have it DKIM-sign with your own domain and make sure both align with your From address for DMARC. Since February 2024, Google and Yahoo require SPF, DKIM and DMARC from senders of more than 5,000 messages a day, and Microsoft applied similar rules to Outlook.com in May 2025.
Monitor Logs, Bounces and Reputation
Review relay logs for unusual volume, new destinations and failed logins. Watch bounce rates and DMARC reports for mail you did not send.
How to Choose an Email Relay Service
Security and Compliance Criteria (Data Residency, Logging)
Check authentication options, TLS enforcement, log retention, role-based admin access and where data is processed. Under the UK GDPR, the relay provider is a processor and needs a written contract.
Deliverability, Dedicated IPs and Bulk Sender Rules
Shared IPs suit low volumes. A dedicated IP gives you control of reputation but needs steady volume to stay warm. Confirm the service supports custom DKIM, one-click unsubscribe for marketing mail and bulk sender rules.
Pricing Models
Providers charge per message volume, per month or per dedicated IP. Compare current list prices directly, since plans change.
Common SMTP Relay Configuration Mistakes
- Leaving an internal relay open to every device on the network
- Using one shared password for every printer and app
- Not adding the relay to SPF, so mail fails DMARC
- Allowing plain-text fallback when TLS fails
- Forgetting relay credentials when staff or vendors leave
- Leaving Direct Send enabled when nothing uses it
Email Relay Services Are Part of Your Email Perimeter
Email relay services are not a printer setting. They are a side door to your domain’s reputation, and they deserve the same controls as staff mailboxes. Start by listing every device and app that sends mail, and confirm each one authenticates with its own credential over TLS before the Microsoft change in December 2026. If you would like help mapping your senders, Cyber Security Solutions Ltd offers a free assessment through our contact page.
FAQs
No. SMTP relay is the act of passing mail through a server to another destination. SMTP authentication (SMTP AUTH) is one way a sender proves it is allowed to use that relay, using credentials. A relay can also authenticate senders by IP address or certificate. Secure relays always use some form of authentication.
Usually not for small volumes. Shared IPs from a reputable provider work well for most businesses sending transactional mail. A dedicated IP makes sense when you send steady, high volumes and want full control over reputation. It must be warmed up gradually, and low or irregular volume can hurt deliverability on a dedicated IP.
An open relay is an SMTP server that forwards mail from anyone to anyone without authentication. Spammers can use them to send mail that appears to come from the relay's owner. The result is usually blocklisting, which stops your legitimate mail from being delivered. Every relay should require authentication.
Use port 587 with STARTTLS or port 465 with implicit TLS for submitting mail to a relay. RFC 8314 (2018) recommends implicit TLS. Port 25 is for server-to-server delivery and is often blocked on cloud and residential networks. Port 2525 is a non-standard fallback some providers offer.
Yes, if it is set up correctly. Add the relay's servers to your SPF record and have it DKIM-sign messages with your own domain, so the signing domain aligns with your From address. DMARC passes when either aligned SPF or aligned DKIM passes. Test with a DMARC report or a header check before going live.
Microsoft plans to disable Basic authentication for SMTP AUTH client submission by default at the end of December 2026. Check whether your printer supports OAuth. If not, move it to an SMTP relay connector using your office's static IP or certificate, or to a third-party relay service with its own credential.
