An SMTP relay (also called a smarthost) is a mail server that accepts your outgoing email and delivers it onward. Instead of your server talking directly to every recipient's mail server, it hands mail to the relay. This guide explains when an SMTP relay helps and how to set one up.
Before you start
- An account with a relay provider (a transactional email service, or your mailbox provider's SMTP) with hostname, port and credentials.
- Access to your domain's DNS.
Why use an SMTP relay?
- Port 25 is blocked – many VPS and cloud providers block outbound port 25.
- Better deliverability – relay providers manage IP reputation, feedback loops and bounces.
- New or shared IP – a fresh VPS IP has no sending reputation yet.
- Volume and tracking – bulk or transactional mail with analytics.
Ports and encryption
| Port | Use | Encryption |
|---|---|---|
| 25 | Server-to-server delivery | Opportunistic STARTTLS |
| 587 | Authenticated submission (clients, apps, relays) | STARTTLS |
| 465 | Authenticated submission | Implicit TLS |
| 2525 | Alternative offered by some relays | STARTTLS |
Use 587 or 465 with a username and password (or API key) for relays.
DNS for relayed mail
- SPF – add the relay's include to your single SPF record, for example
v=spf1 include:relay.example ~all. - DKIM – publish the CNAME or TXT keys the provider gives you, so mail is signed with your domain.
- DMARC – make sure the From domain aligns with SPF or DKIM.
Configure Postfix to use a relay
relayhost = [smtp.relay.example]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_security_level = encryptCreate /etc/postfix/sasl_passwd with [smtp.relay.example]:587 user:password, run chmod 600 and postmap on it, then reload Postfix.
Configure Exim to use a relay (non-panel servers)
On Debian/Ubuntu, run dpkg-reconfigure exim4-config, choose "mail sent by smarthost", enter smtp.relay.example::587, and put credentials in /etc/exim4/passwd.client as smtp.relay.example:user:password. On cPanel servers, a smarthost is set in WHM → Exim Configuration Manager → Basic Editor (Smarthost support) instead of editing files.
Apps without a local mail server
Most apps (WordPress, WHMCS, Laravel) can send straight to a relay with SMTP settings: host, port 587, TLS, username and password. That avoids running any MTA on the server.
Troubleshooting
- 535 authentication failed: wrong credentials or the provider requires an API key as the password.
- Connection timeout on 587: outbound firewall; try 465 or 2525.
- Mail delivered but in spam: SPF/DKIM not set up for the relay, or DMARC misaligned.
- "Sender address rejected": the relay only allows verified sender domains or addresses.
FAQ: SMTP relays
Is an SMTP relay the same as an open relay?
No. A legitimate relay requires authentication. An open relay accepts mail from anyone and is quickly abused by spammers.
Do I still need my own mail server?
For sending only, no – apps can send directly to the relay. Receiving mail still needs a mailbox host.
Will a relay fix all deliverability problems?
It helps with IP reputation, but content, list quality and authentication still matter.