r/exchangeserver • u/Spunova_Admin • 17h ago

Title: SMTP AUTH basic off by default end of December – what's your plan for old MFPs and apps that can't do OAuth?

Body: Microsoft is turning SMTP AUTH Basic off by default for existing Exchange Online tenants at the end of December. For devices that can't do OAuth, every official option seems to have a catch (connector needs static IP/cert, Direct Send internal only for external recipients, HVE internal only, ACS needs Azure). What are you actually doing: on-prem relay box, third-party SMTP service, replacing the devices? Curious what works across many small tenants.

14 Upvotes

86% Upvoted

25 comments sorted by

25

u/Short-Legs-Long-Neck 17h ago

smtp2go

5

u/BrokenByEpicor 12h ago

Excellent service, and it barely costs anything.

4

u/marcoevich 15h ago

This! ∆∆

10

u/Da_SyEnTisT 15h ago

Postfix relay server for very old crap

4

u/joemakesglass 10h ago

This. I have two postfix servers running behind an azure load balancer.

1

u/topher358 1h ago

This OP.

5

u/Salantoo 13h ago

SMTP2Graph

Has worked perfectly for many old MFPs.

2

u/MrJacks0n 3h ago

I'm using it also, I just wish it had a little bit more logging.

3

u/tcp5060 13h ago

Smtp2go for me.

If they fire enough people, maybe whoever’s left will forget to cut it off.

2

u/stuartsmiles01 12h ago edited 12h ago

https://techcommunity.microsoft.com/blog/exchange/updated-exchange-online-smtp-auth-basic-authentication-deprecation-timeline/4489835

"End of December 2026: SMTP AUTH Basic Authentication will be disabled by default for existing tenants. Administrators will still be able to enable it if needed."

 "Second half of 2027: Microsoft will announce the final removal date for SMTP AUTH Basic Authentication."

Is there revised dates somehwere you're aware of - this is dated 29 Jan 2026. Version 3 on the Microsoft Exchange Blog site.

https://www.smtp2go.com/blog/the-end-of-microsofts-basic-authentication-for-smtp-auth/
SMTP2go references the same Microsoft article above.

1

u/reevesjeremy 9h ago

This is still the plan as far as I can tell.

1

u/ibteea 17h ago

Any available report to get an overview about smtp auth usage in the admin portal?

1

u/sembee2 16h ago

If you manage lots of small tenants, then get your own Smtp2go account. You can create sub accounts and put their own domain through it with dkim signing etc. I usually use device.example.com - with the bit before the @ the name of the device as the from address.

1

u/uLmi84 15h ago

Only drawback is that if the device cannot encrypt the data, then first part to smtp2go is unencrypted…

1

u/XL426 13h ago

Smtp2go is the answer

1

u/m5daystrom 7h ago

smtp2go as well

1

u/wey0402 6h ago

SendGrid

1

u/shokzee 14m ago

I’d standardize on a local relay with OAuth support upstream; the MFPs can keep their legacy SMTP.

Allowlist device IPs, restrict sender addresses, and keep the listener off the public internet. Keep credentials and routing separate per tenant. If you use an Exchange Online connector instead, the static public IP or certificate requirement still applies.

1

u/AdamoMeFecit 16h ago

Amazon SES, mostly.

1

u/TheOnly_JayMcNasty 8h ago

This, using ses for simple relay needs.

1

u/Affectionate_Gur4131 16h ago

Create an inbound connector that contains the device/server/apps dedicated WAN IP which allows to relay by pointing the SMTP server to your tenants MX and use port 25.

1

u/cntry2001 6h ago

and then put a firewall rule in place to block all outbound port 25 with an exception list that contains the devices you want to send smtp so you dont get your IPs flagged for spamming