# What is a smart host, and when do you need an SMTP relay?

URL: https://iblockspam.com/blog/what-is-a-smart-host-smtp-relay
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Email security basics
Author: iBlockSpam Team

> What a smart host (SMTP relay) is, how it differs from an open relay, when apps, printers and servers need one, how to authenticate, and the SPF and DKIM impact.

## Short answer

A smart host is an SMTP server that your mail server, app or device hands all outgoing mail to, instead of delivering directly to each recipient's MX. It relays only for senders it recognizes by login, IP address or certificate, unlike an open relay. Add it to your SPF record and have it DKIM-sign with your domain.

Most mail servers, apps and devices can deliver email in one of two ways: look up each recipient's MX record and connect to it directly, or hand everything to one trusted server and let it do the delivery. That trusted server is a **smart host**. This guide explains what one is, how it differs from the open relays that spammers love, when you need one, and what it changes in your SPF and DKIM setup. For background on SMTP itself, see [what SMTP is](https://iblockspam.com/blog/what-is-smtp).

## What is a smart host?

A smart host is an SMTP relay that a sending system is configured to use for all of its outbound mail. Microsoft's [Exchange Server documentation](https://learn.microsoft.com/en-us/exchange/mail-flow/connectors/send-connectors) describes it this way: "When you route mail through a smart host, the Send connector forwards mail to the smart host, and the smart host is responsible for routing mail to next hop on its way to the ultimate destination."

Postfix calls the same setting `relayhost`. The [Postfix SASL guide](https://www.postfix.org/SASL_README.html) says it "forces the Postfix SMTP to send all remote messages to the specified mail server instead of trying to deliver them directly to their destination."

The terms overlap. **SMTP relay** is any server that receives a message and passes it on, rather than storing it in a mailbox. **Smart host** describes that relay from the sender's point of view: the single next hop for everything going out.

## How is a smart host different from an open relay?

The difference is who the relay agrees to serve.

| | Direct delivery | Smart host | Open relay |
|---|---|---|---|
| Who it accepts mail from | Not applicable | Only identified senders | Anyone on the internet |
| Who delivers to the recipient's MX | Your own server | The smart host | The open relay |
| How senders are identified | Not applicable | Login, IP address or certificate | Not at all |
| Outbound port your network needs | 25 | Usually 587 or 465; sometimes 25 | Not applicable |
| Status | Legitimate if well run | Legitimate and common | A misconfiguration abused for spam |

[RFC 5321](https://www.rfc-editor.org/rfc/rfc5321.html) lets servers refuse to relay: they "MAY decline to accept mail that is destined for other hosts or systems." [RFC 6409](https://www.rfc-editor.org/rfc/rfc6409.html), which defines message submission, goes further. A submission server "MUST, by default, issue an error response to the MAIL command if the session has not been authenticated", unless it has established authorization another way, such as a protected subnetwork. It warns that a site that skips this "is allowing open use of its resources and name; unsolicited bulk email can be injected using its facilities."

A smart host is a relay that follows those rules. An open relay is one that doesn't.

## When do you need a smart host?

### Applications, websites and scripts

Contact forms, booking systems, invoicing tools and monitoring alerts all send mail. Sending directly from a web server often fails: the IP has no mail reputation, reverse DNS doesn't match, and the server may not be in your SPF record. Our guide to [website form emails going to spam](https://iblockspam.com/blog/website-form-emails-going-to-spam) covers the symptoms.

### Printers, scanners and other devices

Multifunction printers and line-of-business devices usually can't queue and retry mail like a real server. They need a relay to hand off to. If you use Microsoft 365, [sending scan to email through Microsoft 365](https://iblockspam.com/blog/microsoft-365-scan-to-email-smtp) compares Microsoft's options, including its relay connector.

### On-premises mail servers

Exchange Server, Postfix and similar servers can deliver directly, but many organizations route outbound mail through a smart host for filtering, signing or reputation. Microsoft notes that "a common use for smart host routing is to send outgoing mail through an antispam service or device."

### Networks that block port 25

Many ISPs and cloud platforms block outbound port 25. The [Azure documentation](https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-network/troubleshoot-outbound-smtp-connectivity) says: "The Azure platform blocks outbound SMTP connections on TCP port 25 for deployed VMs" on most subscription types, and recommends authenticated SMTP relay services, noting that port 587 "isn't restricted in Azure, regardless of the subscription type." [M3AAWG still recommends](https://www.m3aawg.org/blog/Port25DocumentRefresh) that providers block port 25 "for all but a few restricted purposes". Our guide to [SMTP ports 25, 587 and 465](https://iblockspam.com/blog/smtp-ports-25-587-465) covers the other big clouds.

M3AAWG also lists what providers gain by routing mail through authenticated relays: they "can identify the party responsible for submitted messages", "filter out spam, viruses, and other abusive message payloads", and "monitor and limit" sending rates.

## How do you authenticate to a smart host?

Every legitimate smart host needs some way to know the mail is yours. [RFC 6409](https://www.rfc-editor.org/rfc/rfc6409.html) lists the methods in use: "authenticated SMTP, IP address restrictions, secure IP and other tunnels". In practice you'll meet these:

| Method | How it works | Good for | Watch out for |
|---|---|---|---|
| SMTP AUTH over TLS | Username and password (or OAuth), usually on port 587 or 465 | Apps, servers, most devices | Credentials stored in the device; providers retiring basic auth |
| IP address allow-listing | The relay accepts mail from your static public IP | Offices with a fixed IP, on-premises servers | RFC 6409 notes IP restrictions "can be easily spoofed unless all transport paths ... are trustworthy" |
| TLS client certificate | The relay checks a certificate your server presents | Server-to-server relays and connectors | Certificate renewal |
| Externally secured | A VPN or IPsec tunnel, or a trusted private network | Internal relays | Only as safe as the network |

Exchange Server's send connector exposes the same choices, from **None** (access restricted by source IP) to **Offer basic authentication only after starting TLS**. Microsoft notes that plain **Basic authentication** sends the username and password "in clear text", so always use TLS.

If you relay through Microsoft 365, plan for the retirement of basic authentication for SMTP AUTH. Our guide to [Microsoft 365 SMTP AUTH and basic auth retirement](https://iblockspam.com/blog/microsoft-365-smtp-auth-basic-auth-retirement) covers the timeline.

## What does a smart host change for SPF and DKIM?

Once a smart host delivers your mail, receivers see the smart host, not your server. That has three consequences.

**1. SPF must authorize the smart host.** SPF ([RFC 7208](https://www.rfc-editor.org/rfc/rfc7208.html)) checks whether the IP address connecting to the receiver is authorized by the domain in the envelope sender. That IP now belongs to the relay. Add your relay provider's `include:` or IP ranges to the SPF record of the envelope domain, and watch the 10-lookup limit. The [SPF Checker](https://iblockspam.com/tools/spf-checker) counts lookups for you.

**2. DKIM should be signed with your domain.** Ask the relay to sign with `d=` set to your domain or a subdomain of it, and publish the public key it gives you. That aligned signature is what lets DMARC pass, and unlike SPF it generally survives forwarding. Check the published key with the [DKIM Checker](https://iblockspam.com/tools/dkim-checker).

**3. Reputation and reverse DNS become the relay's.** Receivers judge the relay's IP: its reputation, its blocklist status and whether its reverse DNS looks like a mail server. That's usually an improvement over a web server's IP. You can check a relay IP with the [PTR Lookup](https://iblockspam.com/tools/ptr-lookup).

## How do you set up a smart host?

The details depend on your software, but the steps are the same:

1. **Get the relay details** from your provider: host name, port, authentication method and, if needed, credentials.
2. **Point your sender at it.** In Postfix, that's `relayhost = [mail.isp.example]:submission` plus SASL settings, as the [Postfix SASL guide](https://www.postfix.org/SASL_README.html) shows; the square brackets stop Postfix from looking up MX records for that name. In Exchange Server, create a send connector that routes mail through smart hosts. On a device, enter the server, port and login in its SMTP settings.
3. **Require TLS** for the connection to the relay.
4. **Update SPF** to include the relay.
5. **Turn on DKIM signing** at the relay for your domain and publish the key.
6. **Send a test** to an outside mailbox and read the headers in the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer). Confirm the message went through the relay, and that SPF, DKIM and DMARC all pass.

Our guide on [how to check if an email passed SPF, DKIM and DMARC](https://iblockspam.com/blog/check-if-email-passed-spf-dkim-dmarc) walks through that last step.

## Does iBlockSpam include a smart host?

Yes. Both iBlockSpam plans include an [outbound relay](https://iblockspam.com/features/outbound-relay) that works as a smart host, with DKIM signing and outbound filtering, and 500 relay messages per domain per month included. It suits apps, devices and servers that need a trusted relay alongside your inbound filtering. For higher-volume sending, such as newsletters, use a dedicated sending service.

## Next steps

1. List everything that sends mail as your domain: mail platform, apps, website, printers and servers.
2. For each one, note whether it delivers directly or through a relay, and whether that relay is in your SPF record.
3. Check that each relay signs with your domain's DKIM key.
4. Move anything still sending directly from a server with a blocked port or a poor IP to an authenticated relay on port 587.

Browse our other [email basics guides](https://iblockspam.com/blog/topic/basics).

## Frequently asked questions

### What is the difference between a smart host and an SMTP relay?

In everyday use they mean the same thing. 'SMTP relay' is the general term for any server that passes mail on to another server. 'Smart host' describes the role from the sender's side: the one relay that a mail server, app or device is configured to send all its outbound mail through, instead of looking up each recipient's MX itself.

### Is a smart host the same as an open relay?

No. A smart host relays only for senders it can identify, by username and password, a known IP address or a certificate. An open relay accepts mail from anyone on the internet and sends it anywhere, which makes it a tool for spammers. RFC 6409 says a submission server that requires no authorization allows open use of its resources and name.

### Which port does a smart host use?

Authenticated submission normally uses port 587 with STARTTLS or port 465 with implicit TLS. Relays that identify you by IP address or certificate often listen on port 25. Use what your provider documents. Port 587 is usually the safe choice because many networks and cloud platforms block outbound port 25.

### Do I need to change SPF when I use a smart host?

Usually yes. Receivers check SPF against the server that connects to them, which is now the smart host, not your own server. Add the relay provider's include or IP ranges to the SPF record of the domain used in the envelope sender, and keep within the 10-lookup limit. Also make sure the relay signs DKIM with your domain.

### Why use a smart host instead of sending directly?

Direct delivery needs open outbound port 25, a static IP with good reputation, matching reverse DNS, and retry handling. Many home, business and cloud networks block port 25 entirely. A smart host takes over those jobs, and providers can filter, rate-limit and sign mail centrally, which M3AAWG lists among the benefits of aggregating traffic through relays.

## Sources

- [Microsoft Learn: Send connectors in Exchange Server (smart host routing and authentication)](https://learn.microsoft.com/en-us/exchange/mail-flow/connectors/send-connectors)
- [Postfix SASL Howto: enabling SASL authentication in the Postfix SMTP client (relayhost)](https://www.postfix.org/SASL_README.html)
- [RFC 6409: Message Submission for Mail](https://www.rfc-editor.org/rfc/rfc6409.html)
- [RFC 5321: Simple Mail Transfer Protocol](https://www.rfc-editor.org/rfc/rfc5321.html)
- [M3AAWG: Port 25 Document Refresh](https://www.m3aawg.org/blog/Port25DocumentRefresh)
- [Microsoft Learn: Troubleshoot outbound SMTP connectivity problems in Azure](https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-network/troubleshoot-outbound-smtp-connectivity)
- [RFC 7208: Sender Policy Framework (SPF)](https://www.rfc-editor.org/rfc/rfc7208.html)

## Free tools for this guide

- [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings.
- [DKIM Checker](https://iblockspam.com/tools/dkim-checker): Validate DKIM keys by selector, including key type and strength.
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Reverse DNS (PTR) Lookup](https://iblockspam.com/tools/ptr-lookup): Check PTR records, forward-confirmed reverse DNS and generic-looking host names.

---

Source: iBlockSpam, https://iblockspam.com/blog/what-is-a-smart-host-smtp-relay (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt