Microsoft documents two ways for devices to send without authenticating: Direct Send and an SMTP relay connector. Both are free. Both were designed before the current security posture, and both have limits that show up in exactly the small sites that need them.
| Direct Send | Relay connector | SMTP-365 | |
|---|---|---|---|
| How devices send | To your MX host, port 25, no login | To your MX host, port 25, no login; a connector attributes mail by your public IP or certificate | To an appliance on your LAN, any port, no login; the appliance sends through Microsoft Graph with an application identity |
| Recipients | Internal only | Internal and external | Internal and external, plus SharePoint folders |
| Authentication to Microsoft | None | None; trust by source IP | OAuth2 client credentials; at most three application permissions (Mail.Send, Sites.Selected and, for large attachments, Mail.ReadWrite), with the mail permissions limited to the scanner mailbox once you apply the Exchange scope shown during setup (recommended) |
| Static public IP needed | No | Yes (or a device-side certificate, which printers rarely support) | No |
| Outbound port 25 from the office | Required; often blocked by ISPs | Required | Not needed; HTTPS only |
| Spoofing exposure | Anyone can send "internal" mail to your users by targeting your MX record; the reason the Reject Direct Send setting exists | Anyone on your public IP can send as any address in your domain | Only devices on allowed LAN subnets can submit; sending can be restricted to the scanner mailboxes with the Exchange scope shown during setup (recommended) |
| Future-proof | Being locked down; expect it to be off by default | Supported, but breaks when the IP changes or the ISP moves you to CGNAT | Uses the API Microsoft is investing in |
| Admin effort | Low | Exchange admin: connector, IP, testing, documentation | Twenty minutes in a browser; the app registration is created for you |
| Cost | Free | Free, plus the static IP | £149 once per appliance |
A relay connector is a perfectly good answer for an organisation with a fixed public IP, an Exchange administrator and no interest in SharePoint scanning. For everyone else, and for anyone whose security review asks "why is unauthenticated mail leaving the building?", a relay inside the network with a real application identity is the cleaner answer. It also brings every other device along: the same appliance that fixes the printers handles the UPS, the iDRAC, the NAS and the phone system.
Keep it during the trial. Point one printer at SMTP-365, confirm scans arrive, move the rest, then remove the connector and the port 25 firewall rule.
Updated 2026-10-10. Menu names and screens vary between models and firmware versions; if yours differs, look for the same fields under the device's email, SMTP or notification settings. Corrections welcome at helpdesk@smtp-365.com.