What a smart host is
A smart host is a mail server that sends mail on behalf of another system. Instead of your server delivering outgoing mail directly to every recipient, it hands the mail to the smart host, which delivers it.
iBlockSpam's outbound relay is a smart host for your domain. It adds:
- DKIM signing, so recipients can verify mail genuinely came from your domain and wasn't altered;
- outbound filtering, so spam or malware sent from a compromised account or device can be caught before it leaves.
Who it's for
| Situation | Is the relay useful? |
|---|---|
| Everyone sends from Microsoft 365 or Google Workspace | Usually not needed for everyday mail; your platform already sends and signs |
| A self-hosted mail server (for example cPanel/WHM or Exchange) | Yes: adds DKIM signing and outbound filtering |
| A scanner, printer or alarm system that sends email | Yes, if the volume is low |
| A website contact form or small business app | Yes, if the volume is low |
| Newsletters or marketing campaigns | No: use a dedicated bulk-mail service |
Limits
- 500 outbound relay messages per domain per month, on both plans.
- The relay is for normal business mail, not bulk or marketing mail.
If you're not sure how much your server or devices send, check your mail server's logs over a typical month before you switch.
Why DKIM signing matters
DKIM (RFC 6376) adds a cryptographic signature to each message. The receiving server looks up a public key in your DNS, under a selector, and checks the signature. A valid DKIM signature:
- shows the message was authorized by your domain;
- shows the signed parts weren't changed in transit;
- helps your mail pass DMARC (RFC 9989), which major mailbox providers increasingly expect.
After setup, use our DKIM Checker to confirm the selector's public key is published. If our checker can't find a selector, that means it's unknown to us, not necessarily broken; if you know the selector name, test it directly.
Setting it up
1. Update SPF
Your SPF record (RFC 7208) must authorize the relay. Add the include given in your setup steps. Keep within SPF's limit of 10 DNS lookups; too many includes cause a "permerror" and SPF fails. Our SPF Checker counts lookups for you.
2. Publish the DKIM key
Add the DKIM public key record given in your setup steps to your DNS, then confirm it with the DKIM Checker.
3. Point your server or device at the relay
Configure your mail server's smart host setting, or your device's SMTP settings, with the relay connection details from your setup steps. Use TLS where your server or device supports it.
4. Test
Send a test message to an outside mailbox. Open its headers in the Email Header Analyzer and check that DKIM passes with your domain and SPF passes.
Related
Frequently asked questions
Is 500 messages a month enough?
It's designed for low-volume sending: a self-hosted server, a scanner, a website contact form or a line-of-business app. It isn't meant for newsletters or bulk mail. If you send through Microsoft 365 or Google Workspace already, you probably don't need the relay for everyday mail.
Do I need to change my SPF record?
If you send mail through the relay, your SPF record needs to authorize it. The relay setup steps give you the exact include to add. Watch the 10-DNS-lookup limit in RFC 7208; our SPF Checker counts lookups for you.
Is outbound relay included in Protect?
Yes. Outbound relay with DKIM signing and outbound filtering is included on both Protect and Protect Plus, with 500 outbound relay messages per domain per month.
Related guides
What does the SMTP AUTH Basic auth retirement mean for your Microsoft 365 tenant?
Microsoft is turning off Basic auth for SMTP AUTH in Exchange Online. The current timeline, who is affected, how to find them, and the options to switch to.
9 min read Email security basicsSMTP ports 25, 587, 465 and 2525: which one should you use?
Which SMTP port to use: 25 for server-to-server relay, 587 with STARTTLS or 465 with implicit TLS for sending from apps, and why port 25 is often blocked.
9 min read SPF, DKIM & DMARCHow to set up DKIM in Microsoft 365 and Google Workspace
Step-by-step DKIM setup for Microsoft 365 (two CNAME selectors) and Google Workspace (one TXT key): 2048-bit keys, key rotation and how to verify it works.
9 min readLast updated: