Email server settings

Office 365 SMTP settings (Microsoft 365)

Q: What are the Office 365 SMTP settings?

Server smtp.office365.com, port 587, STARTTLS with TLS 1.2 or 1.3, and the full address of a licensed mailbox as the user name. SMTP AUTH must be enabled for that mailbox, and OAuth 2.0 is the sign-in Microsoft recommends.

Q: What are the Office 365 IMAP settings?

Server outlook.office365.com, port 993, SSL/TLS (POP3: same server, port 995). Exchange Online accepts only OAuth 2.0 sign-in for IMAP and POP.

The Office 365 SMTP settings are smtp.office365.com, port 587, STARTTLS with TLS 1.2 or 1.3, and the full address of a licensed mailbox as the user name. IMAP and POP3 use outlook.office365.com. Exchange Online expects OAuth sign-in, and SMTP AUTH must be enabled for the mailbox that sends.

Last checked October 9, 2026, against Microsoft’s own documentation.

Office 365 IMAP, POP3 and SMTP servers

Server, port and securityServer	Port and security
IMAP · incomingoutlook.office365.com993 · SSL/TLS	993SSL/TLS
POP3 · incomingoutlook.office365.com995 · SSL/TLS	995SSL/TLS
SMTP · outgoingsmtp.office365.com587 · STARTTLSTLS 1.2 or 1.3 required; port 25 also works, 465 doesn’t. SMTP AUTH must be on for the mailbox; Basic auth (password) still works for now.	587STARTTLS

Sign-in: OAuth 2.0 (modern authentication)

User name: the full address of the Microsoft 365 mailbox, for example jane@example.com. Messages are sent as that mailbox.

Microsoft 365 SMTP settings in detail

Values from Microsoft’s pages on POP3 and IMAP4 in Exchange Online and sending from devices and applications. They apply to every Microsoft 365 business plan (Office 365, O365, M365), whatever your email domain.

TLS 1.2 or later. Microsoft: a device that recommends or defaults to port 465 doesn’t support the TLS versions client submission requires. Use 587 (or 25) with STARTTLS, and the host name, not an IP address.
A licensed mailbox logs in. It sends as itself; another From address needs Send As permission.
SMTP AUTH is often off. It is disabled for organizations created after January 2020 and whenever security defaults are on. An admin enables it per mailbox in the Microsoft 365 admin center (Users → Active users, select the user, then Mail → Manage email apps → Authenticated SMTP) or in PowerShell:
```
Set-CASMailbox -Identity "jane@example.com" -SmtpClientAuthenticationDisabled $false
```
POP3 and IMAP4 are on by default. With security defaults on, they are off.

Exchange Online SMTP settings for printers, scanners and apps

Method	Server	Port	Authentication	Who it reaches
Client submission (SMTP AUTH)	`smtp.office365.com`	587 or 25	Mailbox login or OAuth	Anyone
SMTP relay (connector)	Your MX endpoint, e.g. `example-com.mail.protection.outlook.com`	25	Certificate or static IP address	Anyone
Direct send	Your MX endpoint	25	None	Your own organization only

The relay suits devices without login fields or TLS 1.2. It doesn’t work from dynamic IP addresses, and Microsoft asks for an SPF record so the mail doesn’t land in junk.

Exchange Online has disabled Basic authentication (user name and password) for IMAP, POP, Exchange ActiveSync, EWS and Outlook in all tenants, and nobody can turn it back on (Microsoft Learn). IMAP and POP apps must use OAuth 2.0, which opens Microsoft’s sign-in window, MFA included. App passwords don’t help: Microsoft notes that the end of Basic authentication also ended app passwords for apps that don’t support two-step verification.

SMTP AUTH is the exception, for now. Basic authentication still works for SMTP client submission, but Microsoft has announced its retirement. The updated timeline from January 2026 replaced the earlier plan to remove it in March and April 2026:

When	What changes
Until the end of December 2026	Nothing
End of December 2026	Basic auth for SMTP AUTH disabled by default in existing tenants; admins can turn it back on
Tenants created after December 2026	Basic auth for SMTP AUTH unavailable by default; OAuth is the supported method
Second half of 2027	Microsoft announces the final removal date

What to do before then:

Apps: switch the SMTP login to OAuth 2.0. Developers request the scope https://outlook.office.com/SMTP.Send and log in with AUTH XOAUTH2; services can use the client credentials flow with SMTP.SendAsApp (Microsoft’s OAuth guide).
Printers and scanners without OAuth: move them to an SMTP relay connector, or to direct send for internal recipients only.
High-volume applications: Microsoft points to High Volume Email (internal), Azure Communication Services Email, and the Microsoft Graph sendMail API.

Set up Microsoft 365 in Outlook, Apple Mail, Thunderbird and phones

Outlook (Windows, Mac, new Outlook): add the account with your work address and sign in on the Microsoft page. Outlook usually detects the settings itself, so you don’t need to enter IMAP or SMTP servers.
iPhone and iPad: Settings → Apps → Mail → Mail Accounts → Add Account → Microsoft Exchange, then sign in. On a Mac, add a Microsoft Exchange account in Mail.
Thunderbird: enter your address; if you configure it by hand, use outlook.office365.com (IMAP, 993, SSL/TLS) and smtp.office365.com (587, STARTTLS), and set Authentication method to OAuth2 for both.
Android: use Outlook for Android or the phone’s Exchange account type rather than IMAP.
Devices and line-of-business apps: smtp.office365.com, port 587, STARTTLS, the mailbox’s full address and login, SMTP AUTH enabled; otherwise the relay above.

Common Office 365 SMTP errors

Error or symptom	Fix
`535 5.7.3` Authentication unsuccessful	SMTP AUTH is disabled for the mailbox, or multifactor authentication, security defaults or a Conditional Access policy blocks the login. Check the mailbox’s SMTP AUTH setting with `Get-CASMailbox` in Exchange Online PowerShell, enable SMTP AUTH, or switch the app to OAuth.
`5.7.57` Client not authenticated to send mail, or Client was not authenticated to send anonymous mail during MAIL FROM	The device sent without logging in. Enter the mailbox credentials; if the device has no login fields, use the SMTP relay or direct send to your MX endpoint, not `smtp.office365.com`.
`5.7.60` SMTP; Client does not have permissions to send as this sender	The From address differs from the login. Give the login mailbox Send As permission for that address, or use the SMTP relay.
`535 5.7.139` Authentication unsuccessful, the federated STS URL does not support HTTPS	Your federation server can’t build a secure connection, often because it lacks TLS 1.2. Update it to TLS 1.2.
`550 5.1.8` Bad outbound sender	Microsoft has restricted the mailbox from sending. Secure the account, then remove it from the Restricted Users portal.
Connection fails on port 465	Client submission runs on port 587 (or 25), not 465. Use 587 with STARTTLS and TLS 1.2 or later.

Error texts from Microsoft’s troubleshooting page for printers, scanners and applications. For bounces your recipients’ servers send back, see the SMTP error codes reference, for example 550 5.7.1.

Microsoft 365 sending limits

For SMTP AUTH client submission Microsoft lists 10,000 recipients per day and 30 messages per minute. The SMTP relay has “reasonable limits” without a number and may not be used for bulk mail; High Volume Email has no rate limits but reaches internal recipients only. Campaigns belong on an email service, after an email list cleaning service has removed dead addresses.

Which addresses use Microsoft 365?

You can’t tell from the address: Microsoft 365 mailboxes usually use the company’s own domain (jane@example.com), apart from Microsoft’s onmicrosoft.com domain. The MX record shows it: Exchange Online domains point their MX at an endpoint under mail.protection.outlook.com (Microsoft’s example: contoso-com.mail.protection.outlook.com). Check a domain with the MX lookup.

Personal accounts (outlook.com, hotmail.com, live.com) are a different service: see Outlook.com SMTP settings. Exchange Online rejects unknown recipients with 550 5.1.10; a bulk email verifier finds them before you send.

Sources

Checked on October 9, 2026. Server names, ports and sign-in rules come from these official pages:

Other mailbox providers

Microsoft 365 email settings: FAQ

What are the Office 365 SMTP settings?

Server smtp.office365.com, port 587, STARTTLS with TLS 1.2 or 1.3, and the full address of a licensed mailbox as the user name. SMTP AUTH must be enabled for that mailbox, and OAuth 2.0 is the sign-in Microsoft recommends.

What are the Office 365 IMAP settings?

Server outlook.office365.com, port 993, SSL/TLS (POP3: same server, port 995). Exchange Online accepts only OAuth 2.0 sign-in for IMAP and POP.

Does Office 365 support SMTP port 465?

No. Microsoft says a device that recommends or defaults to port 465 doesn’t support the TLS versions client submission requires. Use port 587 (or 25) with STARTTLS.

Is Microsoft turning off SMTP AUTH?

Microsoft is retiring Basic authentication for SMTP AUTH, not SMTP AUTH itself. Under the January 2026 timeline it is disabled by default for existing tenants at the end of December 2026 (admins can re-enable it), and Microsoft will announce the final removal date in the second half of 2027. OAuth keeps working.

Why do I get “535 5.7.3 Authentication unsuccessful”?

SMTP AUTH is turned off for the mailbox, or MFA, security defaults or a Conditional Access policy blocks the password login. Enable SMTP AUTH for the mailbox, or better, switch the app to OAuth.

Email validation API

Validate Microsoft 365 addresses before you send

emailvalidation.io checks syntax, MX records and the mailbox over SMTP, flags disposable, role and free addresses and returns a quality score, in one request.

/v1/info Email validation API Read the documentation

100 free validations every month. No credit card required.

GET https://api.emailvalidation.io/v1/info?email=support@emailvalidation.io

{
  "email": "support@emailvalidation.io",
  "user": "support",
  "tag": "",
  "domain": "emailvalidation.io",
  "format_valid": true,
  "mx_found": true,
  "smtp_check": true,
  "catch_all": null,
  "role": true,
  "disposable": false,
  "free": false,
  "score": 0.64,
  "state": "deliverable",
  "reason": "low_quality",
  "did_you_mean": "",
  "catch_all_resolution": null,
  "bounce_probability": null,
  "status": "valid",
  "sub_status": "role_based",
  "explanation": "The mailbox exists, but it is a role address (such as info@ or support@), usually read by a team rather than one person.",
  "recommended_action": "send_with_caution"
}

Free email tools

Is this a real email address? Check whether a mailbox exists, without sending an email. Email spam checker Will your email land in spam? Bulk email validator Which addresses on a list are deliverable? Email header analyzer Trace an email’s route and read its SPF, DKIM and DMARC results. Email extractor Pull every email address out of text or a CSV file. SPF record checker Is the SPF record valid? DMARC record checker Is the domain protected against spoofing? Disposable email checker Is this a throwaway address? Email syntax checker Is the address written correctly? MX record lookup Which servers receive mail for a domain? SPF record generator Build an SPF record and count its DNS lookups. DMARC record generator Create a DMARC record and see where it goes. DKIM record checker Is the DKIM key published? DKIM record generator Create a DKIM key pair and its DNS record. Scam email checker Check a sender for look-alike domains and other scam signals. Email blacklist checker Is your domain or mail server IP on a blacklist?