In development · Windows Server 2016 to 2025

SMTP in. Microsoft 365 out. For the devices the free paths leave behind.

A Windows service that accepts plain SMTP from your scanners, old applications and SQL Server jobs on the LAN, and sends through Microsoft Graph over HTTPS 443. No port 25, no static IP, no TLS 1.2 on the device, no third-party mail service in the middle.

Get the first buildCheck the free paths first

Your LANscanner, ERP, SQL Server Database Mail, monitoringSMTP 25 or 587 · AUTH optional · TLS 1.0, 1.1, 1.2 or none
SMTP BridgeWindows service on any server or VMqueue on disk · log per message · retry
Microsoft 365sent from one mailbox of your tenantMicrosoft Graph · HTTPS 443 · app certificate

First, try the free paths from Microsoft

Microsoft gives four ways to send mail from a device or application. Three of them cost nothing or almost nothing. We wrote a working guide for each one. Use them if they fit.

PathWorks from Azure or a cloud VMExternal recipientsDevice needs TLS 1.2Device needs a loginNeeds static IP and port 25Cost
SMTP relay connectorNoYesNoNoYes (or a TLS certificate and port 25)Free
Direct SendOnly with port 25 openNo, your tenant onlyNoNoPort 25, static IP for SPFFree
High Volume Email (HVE)YesNo, your tenant onlyYesYesNo$0.000042 per recipient
Azure Communication Services EmailYesYesYesYesNoAbout $1 a month for 3,000 mails
SMTP client submission (SMTP AUTH)YesYesYesYes, a licensed mailboxNoFree with a mailbox. Basic auth is being retired

Sources: Microsoft Learn, "How to set up a multifunction device or application to send email using Microsoft 365" (updated 2026-10) and the HVE and Azure Communication Services pages. Each guide links to its page.

Where the free paths stop

Every free path has one of these conditions. Many old setups fail all of them at once:

  • The server sits in Azure, AWS or another cloud. Microsoft says the relay connector cannot be used from a third-party hosted service, and most cloud subscriptions block outbound port 25. That removes the connector and Direct Send.
  • The device cannot do TLS 1.2 or cannot log in. A scanner from 2015, a Windows 2012 application, an entry system that only talks to an SMTP server in its own subnet. That removes SMTP AUTH, HVE and Azure Communication Services.
  • You need external recipients. Customer statements, order confirmations, alerts to a vendor. That removes Direct Send and HVE.
  • IIS SMTP is gone. Windows Server 2022 was the last version with the SMTP server feature, and Microsoft does not support it for relay to Microsoft 365. Windows Server 2025 has no SMTP server at all.

The usual answer is a third-party SMTP service for $10 to $30 a month, plus DNS records on your domain, with every message leaving through someone else's servers. SMTP Bridge is for the admins who would rather keep mail inside their own tenant.

What SMTP Bridge does

On the LAN side

  • Listens on port 25 and 587 on any Windows Server 2016 to 2025, as a service. No IIS.
  • Accepts plain SMTP, TLS 1.0, 1.1 and 1.2. Old devices connect as they are.
  • Allowlist by IP address or subnet. SMTP AUTH optional, for devices that insist on it.
  • Reads recipients from the SMTP envelope, so BCC-only and odd headers from scanners work.

On the Microsoft 365 side

  • Sends through Microsoft Graph over HTTPS 443. No port 25, no static IP, no SPF changes.
  • Authenticates as an Entra application with a certificate. No user password, no token to refresh by hand, no secret that expires in a year.
  • Can send only from the one mailbox you choose, enforced with Exchange RBAC for Applications. The setup script is generated for you.
  • Handles Graph throttling with retry and backoff. A burst of 80 reports does not lose mail.

When something goes wrong

  • Queue on disk. If Microsoft 365 is down, mail waits and goes out later.
  • One log line per message: who sent it, to whom, when it was accepted by Graph.
  • A failed folder with the original message and the exact error, plus a notification to the admin.
  • Warning before the application certificate expires.

Installation

  • One MSI, silent install supported, so it deploys through your RMM.
  • Setup wizard in the browser on 127.0.0.1: tenant, application, mailbox, allowlist, test message.
  • Licence allows use for your customers' tenants. MSPs welcome.

Not in the first version

No pickup folder for .eml files. One sending mailbox per service. No automatic self-update. Commercial Microsoft 365 cloud only, no GCC High.

Pricing

199 € one-time, per server

  • 14-day free trial with all features.
  • Updates and support for 12 months included. The service keeps working after that.
  • Managing several customer tenants from one server is allowed by the licence.
  • Payment and invoices by Polar, our merchant of record. VAT is handled at checkout.

Not released yet. The first build goes to the people on the list below, and the trial starts when they install it.

Tell us about your setup, get the first build

One email when the first build is ready, then nothing else. The answers below tell us which devices to test against first.

Does the server have a static public IP address?
Is outbound port 25 open from that server?
Can the device or application do TLS 1.2 and log in with a username and password?
Have you tried a hosted relay such as SMTP2GO, SendGrid or Mailgun?
Does 199 € one-time per server work for you?
How many servers or customer sites would run it?

We store your answers to contact you about SMTP Bridge. Nothing else. Privacy.

Questions admins ask

Is this not just another point of failure?

It is one more service, yes. It replaces the IIS SMTP server or Postfix VM you had before, so the count stays the same. The difference: a disk queue, a log per message and afailed folder, so when something breaks you see it the same hour, not when a customer calls.

What about the token and the expiring secret?

The bridge authenticates with a certificate, not a client secret, using the client credentials flow. Tokens are requested and renewed by the service itself. The certificate can be valid for years, and the bridge warns you 30, 14 and 7 days before it expires.

Is it an open relay?

No. It accepts mail only from the IP addresses and subnets you list, optionally with SMTP AUTH on top, and only on your LAN. It is not reachable from the internet unless you publish it yourself.

Can the application send as any mailbox in my tenant?

No. Mail.Send as an application permission would allow that, which is why the setup script scopes the application to one mailbox with Exchange RBAC for Applications. The bridge rewrites the sender to that mailbox and keeps the original sender in a header.

Does this fix SPF, DKIM and DMARC for my device?

Yes, by removing the problem. Mail is sent by Microsoft 365 from your mailbox, exactly like Outlook does. Your existing SPF, DKIM and DMARC records already cover it. Nothing to add for the device's IP.

Why not SMTP2GO or another hosted relay?

They work, and six of ten admins in the threads we read use one. Choose the bridge when you do not want a third party in the path, do not want a subscription per customer domain, or have a device that cannot do TLS 1.2 or log in at all.

Does it save to Sent Items?

Yes. Mail sent through Graph from a mailbox appears in that mailbox's Sent Items. This is Microsoft's behavior for MIME messages and cannot be turned off.

Is the installer signed?

The first builds are not signed, so SmartScreen shows a warning on manual download. Installation through an RMM or with the silent switch is not affected. Signing comes with the first paid release.