Netgate pfSense email notifications (Notifications SMTP) with Microsoft 365: email through Microsoft 365 after Basic auth is switched off

Short answer: Netgate's Notifications page for pfSense offers only two authentication mechanisms, PLAIN and LOGIN, and doesn't mention OAuth. A Microsoft 365 mailbox login over SMTP AUTH stops working when Basic auth is switched off. Use your MX host on port 25 with no authentication behind a relay connector that trusts the firewall's public IP.

Deadline: Microsoft 365 turns off SMTP AUTH Basic auth by default at the end of December 2026 – dates and background.

Modern authentication (OAuth) support

Not documented. The Netgate page lists Notification E-mail Auth Mechanism with PLAIN and LOGIN only, plus a user name and password. It doesn't mention OAuth or XOAUTH2, and neither does the pfSense CE 2.8.0 release note. The only provider-specific advice on the Notifications page is for Google (an App Password with 2-Step Verification). Release notes for 2.8.1 and later were not read, so a later change can't be ruled out. A mailbox that logs in to smtp.office365.com with a password uses SMTP AUTH Basic auth and is covered by the SMTP AUTH Basic auth switch-off.

What you will see when it breaks

Best fix

  1. Open System → Advanced → Notifications → E-Mail and check E-mail server. If it is smtp.office365.com with an Auth Username and Password, it is using SMTP AUTH. To list every mailbox in the tenant that still logs in this way, run the free SMTP AUTH sender script.
  2. In Exchange admin center, create a relay connector (Mail flow → Connectors, from Your organization's email server) that trusts the static public IP of the firewall's WAN connection.
  3. Change the settings: E-mail server your MX host (for example contoso-com.mail.protection.outlook.com), SMTP Port of E-mail server 25, clear Notification E-Mail Auth Username and Password. Netgate says port 25 may not work except to an internal mail server, because providers often block it; make sure your own ISP allows outbound 25.
  4. Leave Secure SMTP Connection unchecked. Netgate says it makes a direct SSL/TLS connection and isn't compatible with ports that start in plain text and switch with STARTTLS (such as 25 and 587). Netgate says the firewall tries STARTTLS on 25 and 587 when authentication is configured; what it does with authentication off is not documented.
  5. Set From e-mail address to an address in a domain your tenant owns, or Microsoft 365 rejects the message (see 550 5.7.64 TenantAttribution).
  6. Click Save, then Test SMTP Settings (Netgate: save the settings before testing). If it fails, check the connector's IP and the message trace in Exchange admin center.

If it can't do OAuth

  1. No static public IP for a connector? Run a small SMTP relay on your network that signs in to Microsoft 365 with OAuth itself, and point E-mail server at it. Netgate doesn't document OAuth in pfSense, so the relay has to do that step.
  2. Without a connector, the MX host on port 25 is direct send, which only reaches mailboxes inside your organization (Microsoft Learn). Fine for firewall alerts to an admin mailbox, not for outside recipients. See 550 5.7.68 if direct send is blocked in your tenant.
  3. Don't switch the mechanism to LOGIN hoping it will pass: both PLAIN and LOGIN send a password, which is exactly what Basic auth means. Netgate documents the choice only as a server compatibility matter.
  4. Stopgap only: an admin can turn Basic auth for SMTP AUTH back on for now. See the SMTP AUTH change.
GUI path (Netgate docs)Advanced > Notifications > E-Mail (System > Advanced > Notifications)
FieldsDisable SMTP, E-mail server, SMTP Port of E-mail server, Connection Timeout to E-Mail Server, Secure SMTP Connection, Validate SSL/TLS, From e-mail address, Notification E-mail address, Auth Username, Auth Password, Auth Mechanism
Notification E-mail Auth Mechanism optionsPLAIN (default), LOGIN
OAuth / XOAUTH2Not documented (not on the Notifications page or in the CE 2.8.0 release notes)
Ports (Netgate)25 and 587 are the common choices; 25 may not work except to an internal mail server
Secure SMTP ConnectionDirect SSL/TLS only; not compatible with STARTTLS ports 25 and 587
STARTTLS behaviour (Netgate)With Secure SMTP Connection unchecked, the firewall tries STARTTLS on 25 and 587 if authentication is configured
Relay connector valuesE-mail server: your MX host, Port: 25, Auth Username and Password empty
TestTest SMTP Settings button (save first)

Check your domain's SPF and DMARC

A relay sends from your office IP, so it must be in your SPF record.

Several devices to move? The Microsoft 365 SMTP Fix Kit puts every printer, scanner, app and script on one printable guide: decision table, relay connector set-up, per-device steps, a sender worksheet and a checklist.

Get the kit ($19)

Rather have it done for you? I move your devices and apps on Fiverr – relay, Direct Send or OAuth, tested, from $25.

MSP or IT partner? The M365 Readiness Pack checks SMTP AUTH, EWS and SPF/DKIM/DMARC per client tenant and writes a report with your logo (from $49).

Sources

Did this fix it?

What's still not working?

Paste the bounce message or describe what happens. We read every report and add fixes for new errors.

Other devices and apps