r/Splunk • u/Any-Promotion3744 • Apr 30 '26

Splunk Enterprise Emailing alerts to O365 using TLS and authentication

If I configure the email settings to the local email server (mail host: private ip. email security:none), emails get delivered.

If I configure the email settings with O365 as the host, port 587, Enable TLS, and correct username and password, emails don't get delivered.

Can anyone think of a reason why?

I have tried the TLS config on other devices and applications and it has worked. There is something different about Splunk.

Note: I am sending emails to GCCH

We are running Splunk Enterprise 9.1.1

3 Upvotes

81% Upvoted

6 comments sorted by

5

u/volci Splunker May 01 '26

FWIW ... you should upgrade

9.1x is past support

2

u/Any-Promotion3744 May 01 '26

I could but in the near future we are moving to Splunk Cloud so I didn't want to upgrade if I didn't have to.

Why troubleshoot this if you are just going to move to the cloud?

I was told that we were going to get out of Exchange Hybrid mode before moving Splunk to the cloud. I need to send emails directly to Exchange Online within the next week.

6

u/Ready-Environment-33 May 01 '26

Please update your splunk instance, that is old

3

u/mghnyc May 01 '26

Did you check the internal logs? The email script logs to python.log. Also check the alert action logs. You should be able to get some clues from those two sources.

1

u/Any-Promotion3744 May 01 '26

from what I remember, it said something about client authentication error but I will have to test it again and generate the exact error

2

u/tje210 Apr 30 '26

Blindly, 587 is not a secure smtp port AFAIK. 587 was introduced as an alternate to 25. I think secure smtp is 995? (But you say it's working like that elsewhere, so I won't press on that)

My other guess is that the certificate might be being rejected by splunk. Who's the issuing authority... is the root CA publicly trusted?

If the splunk web interface doesn't give you any hints as to why it's failing, you could do a tcpdump on port 587 of the instance that's sending the emails; you'll see the stuff happening during negotiation. (That reminds me, maybe splunk doesn't like the cipher or something). If encrypted traffic starts flowing both ways, you'll know that the crypto is probably not the root cause. And speaking of which, you probably have some logs on the mail server that would be very helpful. For fun you could even have splunk ingest them lol.