Some messages are rejected when you try to use Exchange Online servers as an SMTP relay for on-premises business applications and network hardware devices

Custom business applications and network hardware devices such as printers or faxes frequently use Simple Mail Transfer Protocol (SMTP) relay servers to send email notifications. When you try to use Microsoft Exchange Online servers as an SMTP relay for on-premises business applications and network hardware devices, messages that are destined for mailboxes that are not in the Exchange Online environment are rejected. Additionally, you receive the following error message:

This behavior is by design. If the delivery IP address that tries to relay through Microsoft Forefront Online Protection for Exchange (FOPE) is not in the Outbound Mail Server IP Addresses list for the domain or organization, a "Relay access denied" error message is returned.

In Exchange Online subscriptions, the Outbound Mail Server IP Addresses field in the FOPE Administration Center is deliberately disabled because Exchange Online subscriptions do not include SMTP relay services for mail that is sent from the on-premises environment to Internet email addresses.

For a full, cloud-based SMTP relay experience, purchase a FOPE stand-alone subscription to enable SMTP relay through Microsoft Online Services. For more information about FOPE, visit the following Microsoft website:

To work around this limitation, use one of the following methods, as appropriate for your situation.

Method 1: Relay only to Exchange Online addresses

Exchange Online receives the SMTP relay that is directed to Exchange Online recipients. Because of this, you can program on-premises business applications and network hardware devices to send SMTP mail to Exchange Online recipients.

Note This is more common for programmed warning messages or for reporting email messages. With general-use SMTP applications such as scan-to-email, it is much more difficult to control or to predict the required recipient email address.

1. Make sure that on-premises applications and devices are programmed to send only to recipient email addresses that have a domain suffix that is already implemented in the Exchange Online service. The steps to configure this vary from application to application.
2. Direct SMTP traffic from on-premises applications and devices to use the MX record value that is associated with the Exchange Online tenant service as a SMTP smart host.
3. Make sure that the appropriate recipient object or SMTP address is represented in Exchange Online as a recipient. For more information about how to do this, visit one of the following Microsoft websites:
   • Create a New Mailbox
   • Create a New External Contact
   • Create a New Distribution Group

Method 2: Implement an on-premises SMTP relay service

If full-featured SMTP relay functionality is required and you do not want a FOPE stand-alone subscription, you should implement an on-premises SMTP mail relay server. This functionality can be implemented on any number of different mail servers, products, and versions, based on the business need. For an example of how to do this with Internet Information Services (IIS), click the following article number to view the article in the Microsoft Knowledge Base:For an example of how to configure an on-premises SMTP relay server to send mail as an Exchange Online recipient, click the following article number to view the article in the Microsoft Knowledge Base: