The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →A lightweight SMTP relay lets an application send transactional mail, alerts, or notifications without you running a mail server. In practice you point the app at a hosted SMTP endpoint, or you point it at a local mail server that forwards outbound messages to a hosted provider. The first route is quicker for a single app; the second suits a site where several applications already submit mail to one machine. Expect a working setup in minutes once the provider account, sender identity, and port are in place, though verification and network checks can add time.
Choose the relay pattern first
Both common arrangements send mail through the same kind of hosted SMTP service, but they differ in where the configuration lives and who has to change it.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
SUPPLYZ Direct Replacement for SERVER 86994 Appliance Sbh-1/6, 2.52 Dia, W/86989, Quad | $137.00 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
| Question | Direct hosted SMTP (for example, Amazon SES) | Existing mail server relaying to a provider | Google Workspace SMTP relay |
|---|---|---|---|
| Who connects to the provider? | Each app connects directly over SMTP with TLS | Apps submit to one local server, which forwards outbound mail | Apps and devices connect to smtp-relay.gmail.com |
| Best fit | One or a few apps that can take SMTP settings | Several apps already sending through one local server | An organization already running Google Workspace |
| Credentials | Provider SMTP credentials, separate from AWS access keys and region-specific (AWS documentation) | Credentials configured on the relaying server; clients usually need no change (AWS documentation on mail-server integrations) | Relay is configured in the Google Workspace admin console and can authenticate by IP address |
| Sender rules | Verified sender identity is required | Sender must be authorized with the provider | Governed by the Workspace relay settings for the organization |
| Documented limit | Account and region quotas apply; check the current figures in your account | Set by the upstream provider | Up to 10,000 recipients per day per organization user, per the Google Workspace Admin Help page reviewed; confirm the current figure before relying on it |
Set up a direct hosted SMTP relay
This route is the fastest for one application. The steps below use Amazon SES as the example because its documentation covers the full connection requirements.
Recommended Free Tools
- Verify the sender identity (a domain or a single address) in the SES console for the region you will send from. Until verification completes, messages from that sender are not accepted.
- Open the SMTP settings page for that same region and create SMTP credentials. Save the generated username and password immediately; they are not the same as your AWS access key ID and secret key, and they are tied to the region.
- Note the regional SMTP hostname, which follows this pattern:
email-smtp.<region>.amazonaws.com. - Choose a port and matching TLS mode from the table in the next section. STARTTLS and TLS Wrapper are not interchangeable on the same port.
- Enter the hostname, port, SMTP username, password, and TLS setting in the application’s mail configuration. Store the password in the app’s secret store or environment-level secret settings, not in source code.
- Send a test message to an address you control and check that it arrives, then check the message headers and your provider’s sending logs.
Match the port to the TLS mode
SES requires every SMTP connection to be encrypted with Transport Layer Security. The port determines how the encryption starts.
#1 Best Overall
- 86994 Sbh-1/6, 2.52 Dia, W/86989, Quad Made Exactly to Fit For Most Top Brand Appliances
- Satisfaction Guaranteed. Direct Replacement Sbh-1/6, 2.52 Dia, W/86989, Quad Designed for Easy Installation
- Appliance Sbh-1/6, 2.52 Dia, W/86989, Quad - Meets or Exceeds Original Equipment Manufacturers High Quality Standards. Comes Brand New in Original Retail Packaging
- SUPPLYZ Appliance Sbh-1/6, 2.52 Dia, W/86989, Quad
- Check Description for Model Compatibility. Compatible With Most Appliances
| TLS mode | Ports supported by Amazon SES | What to configure in the app |
|---|---|---|
| STARTTLS | 25, 587, or 2587 | Plain connection that upgrades to TLS; select STARTTLS or “TLS if available” with TLS required |
| TLS Wrapper | 465 or 2465 | Encrypted from the first byte; select SSL/TLS or implicit TLS |
Port 25 needs extra attention on cloud hosts. AWS documents that EC2 throttles port 25 by default. You can request removal of that throttle, switch to another supported port such as 587, or use a VPC endpoint. Switching to 587 is usually the quickest fix for a host that blocks port 25.
Relay through an existing mail server
If several applications already submit mail to a local server, you can leave their settings alone and change only the server. AWS documents integrations for common mail-transfer agents that forward outbound messages to SES, and it describes the change as transparent to existing clients and applications. The trade-off is that the local server becomes a single point you must maintain, monitor, and secure.
On a Postfix host, the outbound side is set through the relay host and the TLS policy for that host. Postfix’s documentation explains that opportunistic TLS can fall back to unencrypted delivery when a handshake fails. For a relay to a provider that requires encryption, choose a policy that enforces TLS for that destination (the smtp_tls_security_level parameter controls this), so mail is never sent in the clear by accident.
Use Google Workspace SMTP relay when you already run Workspace
Google’s admin documentation recommends its SMTP relay service for apps and devices in a Workspace organization. The relay host is smtp-relay.gmail.com, and ports 25, 465, and 587 are listed with SSL/TLS options. Authentication can be set to IP addresses, so the devices or servers allowed to relay must be listed in the admin settings. Each organization user can relay up to 10,000 recipients per day, according to the Google Workspace Admin Help page reviewed for this article. That figure applies to Google’s relay service and is not a general SMTP limit for other providers.
Keep the setup secure
- Use TLS on every connection, and confirm the mode matches the port you chose.
- Keep SMTP credentials out of repositories, container images, and logs.
- Use a separate SMTP credential per application, so you can rotate one without breaking the others.
- Limit which hosts can submit mail through a local relay server, and do not leave it open to unknown clients.
Troubleshoot a relay that fails
Work through the layers in order, because a failure at a lower layer makes the higher ones look broken.
- Connection timeout or refused connection. The network path or port is blocked. Test the hostname and port from the same machine the app runs on, and check outbound firewall or cloud security rules. On EC2, check the port 25 throttle first.
- TLS handshake error. The port and TLS mode do not match. Switch STARTTLS and TLS Wrapper to the pairing shown in the table above.
- Authentication failure. The username or password is wrong, or you used AWS access keys instead of the regional SMTP credentials. Create new SMTP credentials and update the secret store.
- Authorization or sender rejection. The From address is not a verified identity, or the account lacks permission to send from that region. Verify the identity and check the account’s sending permissions.
- Relay rejected by Google Workspace. The sending IP address is not listed in the relay settings, or the daily recipient limit has been reached.
If a message seems to have vanished, check the provider’s sending logs before changing settings. A message that the provider accepted but never delivered points to recipient-side filtering or a bounce, not to the relay configuration.
Which pattern to choose
For one application with no existing mail server, a direct hosted SMTP setup is the simplest path and the one with the fewest moving parts. Choose a local relay server only when several applications already submit mail to one machine and you want to change one configuration instead of many. Choose Google Workspace relay when your organization already runs Workspace and the sending devices can be listed by IP address.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
