This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(275.2, 80%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EYS%3C/text%3E%3C/svg%3E)
I read the following post:
https://techcommunity.microsoft.com/t5/exchange-team-blog/new-opt-in-endpoint-available-for-smtp-auth-clients-still/ba-p/2659652
With this in mind, starting in September 2021, we will reject a small percentage of connections that use TLS1.0 for SMTP AUTH.
I am also experiencing this.
But does this also apply to the legacy endpoint (smtp-legacy.office365.com)?
As far as I have tried, they seem to be blocked just like regular endpoints.
Is this the correct behavior?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(25.6, 67%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJS%3C/text%3E%3C/svg%3E)
Are you following the steps in this article: Enable or disable authenticated client SMTP submission (SMTP AUTH) in Exchange Online?
Did you get any error after executing the steps? You could share any error message or screenshot here.
I tried to execute this step and send the mail.
> Set-TransportConfig -SmtpClientAuthenticationDisabled $true
> Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled
SmtpClientAuthenticationDisabled : True
I got a following error:
535 5.7.139 Authentication unsuccessful, SmtpClientAuthentication is disabled for the Tenant. Visit https://aka.ms/smtp_auth_disabled for more information. [TY1PR01CA0138.jpnprd01.prod.outlook.com]
Is this right what you’ld like to ask?
By the way, I tried to connect to smtp-legacy.office365.com with openssl.
Sometimes, I get an error like the following:
# openssl s_client -connect smtp-legacy.office365.com:587 -starttls smtp -tls1
CONNECTED(00000003)
140683716327312:error:1409E0E5:SSL routines:ssl3_write_bytes:ssl handshake failure:s3_pkt.c:659:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 349 bytes and written 0 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1
Cipher : 0000
Session-ID:
Session-ID-ctx:
Master-Key:
Key-Arg : None
Krb5 Principal: None
PSK identity: None
PSK identity hint: None
Start Time: 1634722039
Timeout : 7200 (sec)
Verify return code: 0 (ok)
---
It looks like the connection is blocked before authentication, with or without SMTP AUTH.
It should be able to connect to smtp-legacy.office365.com with TLS 1.0 every time, shouldn’t it?
Thank you.
Hi,
If you disable it, the error returned should be the expected behavior. Therefore, we highly recommend that you disable SMTP AUTH in your Exchange Online organization, and enable it only for the accounts (that is, mailboxes) that still require it.
This example enables SMTP AUTH for mailbox sean@Company portal .com.
Set-CASMailbox -Identity sean@Company portal .com -SmtpClientAuthenticationDisabled $false
I'm still checking the error you shared above.
This problem looks solved.
Is the following incident relevant?
https://mailservices.isc.upenn.edu/computing/email/penno365/alerts/ms-incidents.html
Title Some users are intermittently unable to access their mailboxes through multiple connection methods when using TLS 1.0
ID EX294404
Thanks for feeding back your update. Seems that I didn't find such information published by Microsoft. I would suggest you contact o365 backend to confirm this situation, thanks for your understanding!
https://learn.microsoft.com/en-us/microsoft-365/business-video/get-help-support?view=o365-worldwide
Thank you.
I'll do that.
A member of my team confirmed it.
He could see this information in administration page.
Thank you very much for your help.
Every endpoint across O365 should be doing this, or will start doing it shortly. Make sure to use TLS 1.2.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(230.39999999999998, 26%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EKD%3C/text%3E%3C/svg%3E)
We have same issue too.
In the support document, opt-in-exchange-online-endpoint-for-legacy-tls-using-smtp-auth:
However, due to significant usage, we've created an opt in endpoint that legacy clients can use with TLS1.0 and TLS1.1.
So I think that we can use TLS1.0 for now if I set the endpoint as smtp-legacy.office365.com and opt-in the option with PowerShell... Isn't it correct?
I think so too.
But some of the connections are blocked.
So I am in trouble.