How can I relay smtp from my azure exchange vm to my mx record *.mail.protection.outlook.com on port 25?

Question

How can I relay smtp from my azure exchange vm to my mx record *.mail.protection.outlook.com on port 25?

AM 20

Anybody have any ideas, how can I smtp relay from my azure exchange vm to my mx record *.mail.protection.outlook.com on port 25?

I've tried adding nsg's and asg's to nsg's. I cant get port 25 to let me handshake. using smtp.office365.com requires authentication, but this is for an exchange hybrid relay server.

I've also noticed that *.mail.protection.outlook.com:587 also doesnt work (which i think the documentation alludes to but doesnt specify).

thanks in advance,

-M

Anusree Nashetty 4,470 Reputation points Microsoft External Staff Moderator

2025-05-08T21:44:44.4966667+00:00
Hi Arroyo, Manuel,

To SMTP relay from your Azure-hosted Exchange hybrid VM to the Microsoft 365 MX endpoint (*.mail.protection.outlook.com) on port 25, you're encountering a known and intentional Azure limitation.

Azure blocks outbound connections on TCP port 25 for most VM SKUs and subscription types, regardless of NSGs or ASGs. This prevents you from sending mail directly to *.mail.protection.outlook.com (Exchange Online Protection) over port 25. This block is to ensure better security for Microsoft partners and customers, protect Microsoft's Azure platform, and conform to industry standards.
For detailed information, please check: Troubleshoot outbound SMTP connectivity problems in Azure

You can check the outbound SMTP connectivity from the VM using psping tool to ensure that outbound traffic is allowed.

c:\>psping smtp.outlook.com:25 or c:\>psping smtp.outlook.com:465

If you have any further queries, let me know. If the information is helpful, please click on Upvote.
AM 20 Reputation points

2025-05-08T22:32:14.1733333+00:00

Hmm, interesting. Thank you for this. I was unaware of this limitation. Is there any kind of exception to be made for internal only relay? We are using this system as a smart host for our internal servers, appliances, and printers.

--M
Anusree Nashetty 4,470 Reputation points Microsoft External Staff Moderator

2025-05-08T23:46:16.8566667+00:00

Hi AM,

Azure does not currently offer exceptions to the port 25 block for internal-only SMTP relay, even if it's for trusted or private use like internal printers, scanners, or appliances.

If you have any further queries, let me know. If the information provided above is helpful, please click on Upvote.
Anusree Nashetty 4,470 Reputation points Microsoft External Staff Moderator

2025-05-09T18:26:39.12+00:00

Hi AM,

You can request Port 25 Unblock from Microsoft. Try this workaround and let me know.

For Enterprise Dev/Test subscriptions, port 25 is blocked by default. It's possible to have this block removed. To request to have the block removed, go to the Cannot send email (SMTP-Port 25) section of the Diagnose and Solve section in the Azure Virtual Network resource in the Azure portal and run the diagnostic. This process exempts the qualified enterprise dev/test subscriptions automatically.

Please check this document: Enterprise and MCA-E
AM 20 Reputation points

2025-05-09T18:40:25.66+00:00

Thank you Anusree. I tried that already, deallocated my vm and brought it back. Unfortunately, that didnt work. The diagnostic doesn't display that it does anything. I do see this is only for "Enterprise and MCA-E", but i don't know how to find out what agreement i am covered under. do you happen to know somewhere i can look, i took over this azure environment from a previous admin and don't know the business in and outs yet.
Anusree Nashetty 4,470 Reputation points Microsoft External Staff Moderator

2025-05-09T19:21:09.38+00:00

Hi AM,

To check your subscription plan, please go to Azure portal:

In the left menu, click Subscriptions, Click your active subscription name. In the Overview blade, look for: Subscription Name.

Also check Support Plans: Click on and open "Help + support" from the menu (or search for it). On the Overview page, you will see the "Support plans" section from the left-hand menu. see which support plan you do have now.
AM 20 Reputation points

2025-05-09T20:45:06.2133333+00:00

hmmm, all mine shows is Microsoft Customer Agreement (highlighted yellow).

Is this the same as an MCA-E?
Anusree Nashetty 4,470 Reputation points Microsoft External Staff Moderator

2025-05-12T17:49:51.7733333+00:00

Hi AM,

Could you please check my solution. If you have any other queries, let me know. If the information is helpful, please click on Upvote and Accept Answer on it.
Anusree Nashetty 4,470 Reputation points Microsoft External Staff Moderator

2025-05-13T18:24:05.14+00:00

Hi AM,

As the information has been helpful to you, could you please Accept Answer on the information provided by me, so that it will be helpful to others in the community and can easily find the solution.

Accepted answer

0 additional answers

Your answer

Anusree Nashetty 4,470 Reputation points Microsoft External Staff Moderator

2025-05-08T21:44:44.4966667+00:00

Hi Arroyo, Manuel,

To SMTP relay from your Azure-hosted Exchange hybrid VM to the Microsoft 365 MX endpoint (*.mail.protection.outlook.com) on port 25, you're encountering a known and intentional Azure limitation.

Azure blocks outbound connections on TCP port 25 for most VM SKUs and subscription types, regardless of NSGs or ASGs. This prevents you from sending mail directly to *.mail.protection.outlook.com (Exchange Online Protection) over port 25. This block is to ensure better security for Microsoft partners and customers, protect Microsoft's Azure platform, and conform to industry standards.
For detailed information, please check: Troubleshoot outbound SMTP connectivity problems in Azure

You can check the outbound SMTP connectivity from the VM using psping tool to ensure that outbound traffic is allowed.

c:\>psping smtp.outlook.com:25 or c:\>psping smtp.outlook.com:465

If you have any further queries, let me know. If the information is helpful, please click on Upvote.
AM 20 Reputation points

2025-05-08T22:32:14.1733333+00:00

Hmm, interesting. Thank you for this. I was unaware of this limitation. Is there any kind of exception to be made for internal only relay? We are using this system as a smart host for our internal servers, appliances, and printers.

--M
Anusree Nashetty 4,470 Reputation points Microsoft External Staff Moderator

2025-05-08T23:46:16.8566667+00:00

Hi AM,

Azure does not currently offer exceptions to the port 25 block for internal-only SMTP relay, even if it's for trusted or private use like internal printers, scanners, or appliances.

If you have any further queries, let me know. If the information provided above is helpful, please click on Upvote.
Anusree Nashetty 4,470 Reputation points Microsoft External Staff Moderator

2025-05-09T18:26:39.12+00:00

Hi AM,

You can request Port 25 Unblock from Microsoft. Try this workaround and let me know.

For Enterprise Dev/Test subscriptions, port 25 is blocked by default. It's possible to have this block removed. To request to have the block removed, go to the Cannot send email (SMTP-Port 25) section of the Diagnose and Solve section in the Azure Virtual Network resource in the Azure portal and run the diagnostic. This process exempts the qualified enterprise dev/test subscriptions automatically.

Please check this document: Enterprise and MCA-E
AM 20 Reputation points

2025-05-09T18:40:25.66+00:00

Thank you Anusree. I tried that already, deallocated my vm and brought it back. Unfortunately, that didnt work. The diagnostic doesn't display that it does anything. I do see this is only for "Enterprise and MCA-E", but i don't know how to find out what agreement i am covered under. do you happen to know somewhere i can look, i took over this azure environment from a previous admin and don't know the business in and outs yet.
Anusree Nashetty 4,470 Reputation points Microsoft External Staff Moderator

2025-05-09T19:21:09.38+00:00

Hi AM,

To check your subscription plan, please go to Azure portal:

In the left menu, click Subscriptions, Click your active subscription name. In the Overview blade, look for: Subscription Name.

Also check Support Plans: Click on and open "Help + support" from the menu (or search for it). On the Overview page, you will see the "Support plans" section from the left-hand menu. see which support plan you do have now.
AM 20 Reputation points

2025-05-09T20:45:06.2133333+00:00

hmmm, all mine shows is Microsoft Customer Agreement (highlighted yellow).

Is this the same as an MCA-E?
Anusree Nashetty 4,470 Reputation points Microsoft External Staff Moderator

2025-05-12T17:49:51.7733333+00:00

Hi AM,

Could you please check my solution. If you have any other queries, let me know. If the information is helpful, please click on Upvote and Accept Answer on it.
Anusree Nashetty 4,470 Reputation points Microsoft External Staff Moderator

2025-05-13T18:24:05.14+00:00

Hi AM,

As the information has been helpful to you, could you please Accept Answer on the information provided by me, so that it will be helpful to others in the community and can easily find the solution.

Answer 1

Hi AM,

Alternate workarounds: Use authenticated SMTP over alternate ports:

Option 1: Use Microsoft 365 (Exchange Online)

SMTP server: smtp.office365.com
Port: 587
Encryption: STARTTLS
Requires authentication with a valid Microsoft 365 account

Option 2: Use a third-party SMTP relay like SendGrid

Azure officially partners with SendGrid
Offers free and paid tiers
Uses port 587 or 465 with authentication

Option 3: Set up a relay VM outside Azure

Host an SMTP relay (e.g., Postfix or Exim) on a VPS or dedicated host with port 25 open
Configure Azure VMs to relay mail through that external server using port 587 or 465.

There are several cloud email services available to use. Some of the prominent names are SendGrid, MailJet, and MailGun(Highly reliable, scalable, and widely used for transactional emails and has a Foundation plan (~$35/month) supporting 50,000+ emails/month). Whichever email service you choose, using them to send emails from Azure is similar, server address and port for SMTP and API endpoint address for REST.

SendGrid is probably the most popular email service option for sending emails from Azure. https://www.twilio.com/docs/sendgrid/for-developers/partners/microsoft-azure-2021

You can upgrade to a Paid SendGrid Plan (Recommended for Azure-native workflows)

SendGrid offers Essentials, Pro, and Premier plans.
The Essentials plan starts at ~$14.95/month for up to 50,000 emails/month.
You can scale to millions of emails/month by moving to the Pro or Premier tiers.
These tiers also include:
Dedicated IPs (for better deliverability)
- High throughput
- API and SMTP relay support over port 587.

Use Azure Communication Services (ACS) Email lhttps://learn.microsoft.com/en-us/azure/communication-services/overview

This is Microsoft's native email service — scalable, reliable, and port 25–safe.

Benefits:

Uses SMTP or REST API
Microsoft-managed infrastructure (excellent deliverability)
Can be integrated with Azure Functions, Logic Apps, VMs, etc.
Offers custom domain + DKIM/SPF support You can send a limited number of email messages. If you exceed the email rate limits for your subscription, your requests are rejected. You can attempt these requests again, after the Retry-After time passes. Take action before reaching the limit by requesting to raise your sending volume limits if needed. https://learn.microsoft.com/en-us/azure/communication-services/concepts/service-limits#email

If you have any further queries, let me know. If the information is helpful, please click on Upvote and Accept Answer on it.

User's image

Share via

How can I relay smtp from my azure exchange vm to my mx record *.mail.protection.outlook.com on port 25?

0 additional answers

Your answer