Windows Server IIS 6.0 SMTP relay forwarding app mail to Microsoft 365: email through Microsoft 365 after Basic auth ends

Short answer: An IIS 6.0 SMTP server that forwards to smtp.office365.com with Basic authentication fails once Basic auth is off, and IIS has no OAuth option. Microsoft doesn't support IIS SMTP for relaying to Microsoft 365: move to Exchange Server or Azure Communication Services, or point each app at a relay connector.

Deadline: Microsoft 365 turns off SMTP AUTH Basic auth by default at the end of December 2026 – dates and background.

Modern authentication (OAuth) support

The IIS 6.0 SMTP virtual server has three outbound logins: Anonymous access, Basic authentication (plaintext) and Integrated Windows Authentication. There is no OAuth, so a smart host set to smtp.office365.com with Basic authentication breaks when the SMTP AUTH Basic auth switch-off reaches your tenant. Microsoft Learn says Windows Server 2022 is the last version with the SMTP server feature (in IIS 6.0), that relaying from it to Microsoft 365 is unsupported, and to use a supported Exchange Server or Azure Communication Services instead. Windows Server 2025 removed the SMTP Server feature and the IIS 6 Management Console. For apps that send mail, Microsoft lists four methods: client SMTP submission (with OAuth), SMTP relay through a connector, Direct Send and High Volume Email.

What you will see when it breaks

Best fix

  1. Check the virtual server in IIS 6.0 Manager: SMTP virtual server → Properties → Delivery. Advanced → Smart host = smtp.office365.com with Outbound Security → Basic authentication means it logs in with a password, which fails once Microsoft turns Basic auth off by default at the end of December 2026. Our free, read-only SMTP AUTH sender script lists every SMTP AUTH sender in your tenant, so you can find the mailbox this server uses.
  2. List what sends through this server (apps, scripts, scanners). Each one needs a new route; pick it per sender.
  3. Microsoft's supported replacement for a local relay: a supported Exchange Server with anonymous relay (not open relay), or Azure Communication Services Email.
  4. Apps on your network that can't do OAuth: send straight to Microsoft 365 through an SMTP relay connector. Settings: your MX host (for example contoso-com.mail.protection.outlook.com), port 25, TLS 1.2 or 1.3, no login, any From address in an accepted domain. The connector trusts a certificate or a static public IP.
  5. Apps that support OAuth: client SMTP submission to smtp.office365.com, port 587, TLS 1.2 or 1.3, with SMTP.Send (user sign-in) or SMTP.SendAsApp (app-only). SMTP AUTH must stay enabled on that mailbox.
  6. Mail only to your own staff: High Volume Email (smtp.hve.mx.microsoft, port 587, HVE account or OAuth) or Direct Send (MX host, port 25, no login). Both reach internal recipients only. Microsoft says most customers don't need Direct Send and it is working on an option to turn Direct Send off by default.
  7. Short-term bridge only, unsupported by Microsoft: keep IIS but drop the password. Create an IP-based relay connector for the server's static public IP, set Advanced → Smart host to your MX host, Outbound connections → TCP port to 25, and Outbound Security to Anonymous access with TLS encryption ticked. Whether IIS 6.0 can present a certificate for a certificate-based connector: not documented.

If it can't do OAuth

  1. Port 25 blocked or no static IP? Relay and Direct Send need port 25 and, for relay, a certificate or a static IP. Use OAuth client submission on port 587, High Volume Email (internal only) or Azure Communication Services.
  2. Server in Azure or another third-party cloud? Microsoft says relay can't be used from there; client submission and High Volume Email support third-party hosted senders.
  3. Stopgap only: Basic login from IIS needs SMTP AUTH on for the mailbox (Set-CASMailbox -Identity relay@yourdomain.com -SmtpClientAuthenticationDisabled $false) and Basic auth still allowed. After the end of December 2026 admins can turn Basic auth back on until a final removal date, which Microsoft will announce in the second half of 2027. Details: Basic auth retirement.
IIS smart host (today)Delivery > Advanced > Smart host = smtp.office365.com with Outbound Security > Basic authentication: breaks
IIS outbound loginsAnonymous access, Basic authentication, Integrated Windows Authentication; no OAuth
Microsoft support statusIIS 6.0 SMTP relaying to Microsoft 365 is unsupported; SMTP Server removed in Windows Server 2025
Relay connector routeMX host, port 25, TLS 1.2/1.3, no login; connector trusts a certificate or static IP
Client submission routesmtp.office365.com, port 587, TLS 1.2/1.3, OAuth (SMTP.Send or SMTP.SendAsApp); SMTP AUTH on for the mailbox
High Volume Email routesmtp.hve.mx.microsoft, port 587, HVE account or OAuth; internal recipients only
Direct Send routeMX host, port 25, TLS optional, no login; internal recipients only
Supported local relayExchange Server with anonymous relay, or Azure Communication Services Email

Check your domain's SPF and DMARC

A relay sends from your office IP, so it must be in your SPF record.

Several devices to move? The Microsoft 365 SMTP Fix Kit puts every printer, scanner, app and script on one printable guide: decision table, relay connector set-up, per-device steps, a sender worksheet and a checklist.

Get the kit ($19)

Rather have it done for you? I move your devices and apps on Fiverr – relay, Direct Send or OAuth, tested, from $25.

Sources

Did this fix it?

What's still not working?

Paste the bounce message or describe what happens. We read every report and add fixes for new errors.

Other devices and apps