Some messages are rejected when you try to use Exchange Online servers as an SMTP relay for on-premises business applications and network hardware devices

Article translations Article translations
Article ID: 2673379 - View products that this article applies to.
Expand all | Collapse all


Custom business applications and network hardware devices such as printers or faxes frequently use Simple Mail Transfer Protocol (SMTP) relay servers to send email notifications. When you try to use Microsoft Exchange Online servers as an SMTP relay for on-premises business applications and network hardware devices, messages that are destined for mailboxes that are not in the Exchange Online environment are rejected. Additionally, you receive the following error message:
<Domain_URL> #5.7.1 smtp;554 5.7.1 <clientemailaddress>: Relay access denied


This behavior is by design. If the delivery IP address that tries to relay through Microsoft Forefront Online Protection for Exchange (FOPE) is not in the Outbound Mail Server IP Addresses list for the domain or organization, a "Relay access denied" error message is returned.

In Exchange Online subscriptions, the Outbound Mail Server IP Addresses field in the FOPE Administration Center is deliberately disabled because Exchange Online subscriptions do not include SMTP relay services for mail that is sent from the on-premises environment to Internet email addresses.


For a full, cloud-based SMTP relay experience, purchase a FOPE stand-alone subscription to enable SMTP relay through Microsoft Online Services. For more information about FOPE, go to Forefront Online Protection for Exchange.


To work around this limitation, use one of the following methods, as appropriate for your situation.

Method 1: Relay only to Exchange Online addresses

Exchange Online receives the SMTP relay that is directed to Exchange Online recipients. Because of this, you can program on-premises business applications and network hardware devices to send SMTP mail to Exchange Online recipients.

Note This is more common for programmed warning messages or for reporting email messages. With general-use SMTP applications such as scan-to-email, it is much more difficult to control or to predict the required recipient email address.
  1. Make sure that on-premises applications and devices are programmed to send only to recipient email addresses that have a domain suffix that is already implemented in the Exchange Online service. The steps to configure this vary from application to application.
  2. Direct SMTP traffic from on-premises applications and devices to use the MX record value that is associated with the Exchange Online tenant service as a SMTP smart host.
  3. Make sure that the appropriate recipient object or SMTP address is represented in Exchange Online as a recipient. For more information about how to do this, go to one of the following Microsoft websites:

Method 2: Implement an on-premises SMTP relay service

If full-featured SMTP relay functionality is required and you do not want a FOPE stand-alone subscription, you should implement an on-premises SMTP mail relay server. This functionality can be implemented on any number of different mail servers, products, and versions, based on the business need. For an example of how to do this with Internet Information Services (IIS), click the following article number to view the article in the Microsoft Knowledge Base:
230235 XCON: How to configure the IIS SMTP service to relay SMTP mail
For an example of how to set up an on-premises SMTP relay server to send mail as an Exchange Online recipient, go to How to Allow a Multi-function Device or Application to Send E-mail through Office 365 Using SMTP.


Article ID: 2673379 - Last Review: February 13, 2014 - Revision: 9.0
Applies to
  • Microsoft Forefront Online Protection for Exchange
  • Microsoft Exchange Online
  • Microsoft Office 365 for education  (pre-upgrade)
  • Microsoft Office 365 for enterprises (pre-upgrade)
o365062011 o365m o365 o365e o365a KB2673379

Give Feedback


Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from