How to set up an Exchange Online SMTP relay connector for a scanner, printer or application

The relay connector is the free path with the fewest demands on the device: no login, no TLS, any sender address in your domain, external recipients allowed. It needs one thing from your network instead: a static public IP address, or a TLS certificate, and outbound port 25.

This guide follows the current Microsoft documentation and adds the checks and errors that the documentation leaves out. Time: about 20 minutes plus DNS.

Does the connector fit your case?

Device needs a username and password	No. Authentication is by IP address or certificate.
Device needs TLS 1.2	No. TLS is optional on this path.
Recipients outside your organization	Yes.
Licensed mailbox needed	No. Any address in an accepted domain, for example `scanner@contoso.com`.
Static public IP address	Yes, not shared with another organization. Dynamic addresses are not allowed. Alternative: a TLS certificate whose subject or SAN contains your accepted domain.
Outbound TCP port 25	Yes. Many ISPs and all pay-as-you-go cloud subscriptions block it.
Server in Azure or another cloud	No. Microsoft: "You can't use SMTP relay to send email from a third-party hosted service (for example, Microsoft Azure) through Microsoft 365 or Office 365."

If the last two rows fail for you, stop here and readwhen the connector cannot work below.

Step 1. Find your MX endpoint

The device will send to the MX host of your tenant, not to smtp.office365.com. In the Microsoft 365 admin center go to Settings → Domains, open your domain, open the DNS records tab and copy the Points to addressof the MX record. It looks like this:

contoso-com.mail.protection.outlook.com

The domain status must be Healthy. Mail for an unverified domain can be lost without a trace.

Step 2. Get the public IP address of the device

This is the address Microsoft 365 sees as the source of the connection, usually the WAN address of your firewall, not the LAN address of the printer. From any machine on the same network:

curl -4 https://ifconfig.me

Confirm with your ISP or in your router that the address is static. If it is not, the connector breaks on the next address change and mail bounces with550 5.7.64 TenantAttribution; Relay Access Denied.

Step 3. Create the inbound connector

Open the Exchange admin center at https://admin.cloud.microsoft/exchange#/connectorsand select Add a connector.
Connection from: Your organization's email server. Connection to:Office 365 (fixed). Next.
Name it, for example Relay from office firewall. Keep Turn it onselected. Leave Retain internal Exchange email headers unselected. Next.
On Authenticating sent email choose By verifying that the IP address of the sending server matches and enter the public IP address from step 2. For a certificate instead, choose the first option and enter the domain from the certificate's subject or SAN, for example *.contoso.com.
Review and Create connector.

Or in Exchange Online PowerShell:

Connect-ExchangeOnline
New-InboundConnector -Name "Relay from office firewall" `
  -ConnectorType OnPremises -SenderDomains * `
  -SenderIPAddresses 203.0.113.10 -RestrictDomainsToIPAddresses $true

If you already have an inbound connector for a hybrid Exchange server, you probably do not need a new one. Check that its address list or certificate domain covers the device.

Step 4. Add the IP address to SPF

Without it, recipients outside your tenant may put the mail in Junk. Edit the TXT record of your domain and add the address before -all or ~all:

v=spf1 include:spf.protection.outlook.com ip4:203.0.113.10 -all

Keep the record under 10 DNS lookups. DKIM and DMARC for the domain stay as they are.

Step 5. Configure the device

Setting	Value
SMTP server or smart host	Your MX endpoint, for example `contoso-com.mail.protection.outlook.com`
Port	25
TLS or STARTTLS	Optional. Turn it on if the device supports TLS 1.2 or 1.3, off otherwise.
Authentication	None
From address	Any address in an accepted domain of your tenant. It does not need a mailbox.

Step 6. Test and read the errors

Send a test to an external address, for example a Gmail account, and to an internal one. Look at the message headers of the received mail: the first Received line should name your public IP address. If the test fails, the device's log or the bounce message has one of these codes:

Error	Meaning	Fix
`550 5.7.64 TenantAttribution; Relay Access Denied`	The connection did not match any connector: wrong IP address, or the From domain is not an accepted domain.	Compare the address in the connector with step 2. Check the From address.
`550 5.7.54 Unable to relay recipient in non-accepted domain`	The connector did not match, so Microsoft treated the mail as Direct Send, which cannot reach external recipients.	Same fix as above. The connector is not active or the IP address differs.
`451 4.7.500 Server busy` or `4.4.62 Mail sent to the wrong Office 365 region`	Throttling, or the device resolved an old MX host.	Retry later. Make sure the device uses the MX host name, not an IP address.
Connection timeout	Outbound port 25 is blocked by your ISP, firewall or cloud provider.	Open the port or move to another path. See below.
Mail arrives in Junk	SPF does not list the IP address, or the address is on a blocklist.	Step 4. Check the address at a blocklist lookup service.

Limits worth knowing

No fixed message limit, but Microsoft applies "reasonable limits" and may route suspicious mail through the high-risk delivery pool. The connector is not for bulk mail.
The connector does not save messages to Sent Items.
If your IP address lands on a blocklist, delivery stops until you clear it.
The device must retry failed connections on its own. Microsoft recommends keeping SMTP logs on the device.

When the connector cannot work

Three situations come up again and again in admin forums:

The server is a VM in Azure, AWS or another cloud. Microsoft excludes third-party hosted services from the relay connector, and pay-as-you-go Azure subscriptions block outbound port 25 with no exemption.
The office has a dynamic IP address. Every address change is an outage. A certificate-based connector avoids the address, but the device must then present the certificate itself, and scanners cannot.
Port 25 is blocked by the ISP, and the ISP will not open it.

In those cases, if your recipients are inside your tenant, look atHigh Volume Email. If the device can do TLS 1.2 and log in, look at Azure Communication Services Email. If the device can do neither and you need external recipients, that is the gap SMTP Bridge covers.

Source: Microsoft Learn, How to set up a multifunction device or application to send email using Microsoft 365 or Office 365, updated October 2026. Error texts from Exchange Online bounce messages.