Send application email through Exchange Server

An application can submit mail to Exchange Server through an administrator-approved SMTP endpoint. Start with authenticated submission where the deployment permits it. Do not solve a rejected message by enabling unrestricted anonymous relay or copying Exchange Online settings onto an on-premises server.

Get the connection contract from your administrator

You need the public or internal submission hostname, port, required authentication mechanism, trusted TLS certificate, authorized service identity, permitted sender, and test recipient. The application host must be allowed to reach that endpoint.

Microsoft documents Client Frontend as the default authenticated client connector on port 587, but administrators can change bindings and authentication policy. Confirm the deployed configuration instead of assuming the default is your organization’s integration contract.

Get-ReceiveConnector -Server "MAIL01" |
  Format-List Identity,Bindings,AuthMechanism,PermissionGroups,RemoteIPRanges

Replace MAIL01 with the approved server. This command inspects settings; it does not grant access. If your organization requires an authentication method not supported by the client example below, use an approved client/relay design rather than weakening server policy.

Submit a controlled message from Node.js

The example uses the Nodemailer SMTP library, not a MailKite or Microsoft HTTP API. It applies only when the administrator explicitly permits a username/password service identity over STARTTLS. Keep the credentials in your deployment’s secret manager; do not use a personal mailbox password.

npm install nodemailer

Save as send-exchange.mjs. Provide EXCHANGE_HOST, EXCHANGE_USER, EXCHANGE_PASSWORD, APP_FROM, and TEST_TO through secure runtime configuration. Set the two addresses to an approved sender and a recipient you control before running a live test.

import nodemailer from "nodemailer";

const required = [
  "EXCHANGE_HOST", "EXCHANGE_USER", "EXCHANGE_PASSWORD",
  "APP_FROM", "TEST_TO",
];
for (const name of required) {
  if (!process.env[name]) throw new Error(`Missing ${name}`);
}

const transport = nodemailer.createTransport({
  host: process.env.EXCHANGE_HOST,
  port: 587,
  secure: false, // STARTTLS, not implicit TLS.
  requireTLS: true,
  auth: {
    user: process.env.EXCHANGE_USER,
    pass: process.env.EXCHANGE_PASSWORD,
  },
  connectionTimeout: 10000,
  socketTimeout: 30000,
});

await transport.verify();
const result = await transport.sendMail({
  from: process.env.APP_FROM,
  to: process.env.TEST_TO,
  subject: "Exchange application integration test",
  text: "A controlled test from the approved application identity.",
});
console.log({ messageId: result.messageId });

Run node send-exchange.mjs only after approval. Do not set rejectUnauthorized: false to work around a certificate error. Fix hostname/certificate trust or configure the approved private CA properly.

Verify more than authentication

verify() checks connection/authentication readiness; it does not prove that the sender is permitted or that mail will reach an external inbox. Check the test recipient and Exchange message tracking. Record SMTP acceptance separately from final delivery, and monitor nondelivery reports.

An authentication failure requires identity/policy review. A relay rejection requires connector/recipient review. A sender-permission failure requires explicit sender authorization, not “allow any sender.” Network-scoped relay is a separate administrator-managed design; this article deliberately provides no broad anonymous-relay permission command.

Persist a send attempt before submission. If a timeout occurs after message data was sent, treat the outcome as unknown and investigate before retrying; an automatic retry can duplicate a message already accepted by Exchange.

Use MailKite for independent application delivery

If the notification does not need to originate through Exchange, a separate verified application domain can use MailKite’s SDK-first sending path. Exchange can continue serving employee mailboxes. MailKite credentials do not authenticate to Exchange, and this does not automatically preserve Exchange transport rules or organizational retention.

References

• Microsoft Receive connectors
• Nodemailer SMTP transport