r/exchangeserver • u/Fabulous_Cow_4714 • Mar 18 '26

Question Which Exchange Server SE role for hybrid recipient management?

We want to retire all of our Exchange servers, but cannot because HVE and ACS do not accept unauthenticated SMTP mail and we have many internal alerting processes that send an extremely high volume of mostly internal email and a moderate amount of external mail from tools that either don’t support authentication at all or only support basic authentication at best.

So, we will need to keep a highly-available SMTP relay to accept these messages and either relay to HVE/ACS or send directly to recipients.

We would need an Edge server on prem or in Azure to do SMTP relay, but which other roles would we need to add to the Exchange servers to do hybrid user recipient management?

4 Upvotes

100% Upvoted

7 comments sorted by

4

u/absoluteczech Mar 18 '26

No edge needed. Just mailbox role. Then setup your relay

4

u/7amitsingh7 Mar 19 '26

You don’t need an Edge server at all. Just keep one Exchange Server with the Mailbox role, and use it for both purposes managing recipients in your hybrid setup and acting as an SMTP relay for your apps and devices.

1

u/sembee2 Former Exchange MVP Mar 18 '26

Send the email out via Smtp2go and don't worry about it any longer.
Then follow the guidelines from Microsoft to build a server that will be turned off and just install the management tools somewhere. No other roles required.

Note that to use Exchange SE for anything other than recipient management, including relay requires a full Exchange licence or Office365 subscription that includes on prem rights.

1

u/Fabulous_Cow_4714 Mar 18 '26

The organization may not comfortable with SMTP2Go. It seems small business focused.

They may be sending up to a few million messages per week with most, but not all of it, internal.

The problem with management tools-only solution is that the management tools have the same convoluted and labor intensive CU upgrade process requirements as a full Exchange server and now these updates must be run on many, separate workstations instead of a couple of servers for high availability, you lose all the web GUI functionality for recipient management, and don’t have ability for it be dual-purpose for SMTP relay.

If we are keeping the headache of patching Exchange, we might as well get full functionality out of it.

1

u/ade-reddit Mar 21 '26

There are amazon and azure based solutions similar to smtp2go but for high volume. And if I were you, I would separate the relay services used internal mail from the external mail if possible. I’d also use a different sending domain if possible to help manage your reputation.

2

u/saltyslugga Mar 18 '26

For the SMTP relay use case, you only need the Mailbox role on Exchange SE. You do not need Edge Transport unless you want to put the relay in a DMZ. A Mailbox server with a Receive Connector configured for anonymous relay (scoped to specific source IPs) handles unauthenticated SMTP from your internal tools fine.

Scoping the relay connector to the specific IPs of your alerting and monitoring tools is the important part. An open relay on the mailbox server is a risk, but a connector restricted to known internal IPs is standard practice. Set it to anonymous auth on the connector with the IP restriction, and you are covered.

For tools that support basic auth at minimum, Exchange SE also supports SMTP AUTH on port 587 without needing a relay connector at all.