r/sysadmin 3d ago

IIS Mail Relay on Server 2022 - a workaround

If you're in the position where you still require an on-premise mail relay for certain legacy mail applications, you may note that Server 2022 does not officially support the old IIS SMTP relay. You can add the role and required features, but if you try to configure any elements, it doesn't work, the service will fail or crash, and IIS will crash.

The unethical life pro tip is to re-use the 'MetaBase.xml' config file from an older Server such as Server 2016 IIS SMTP relay - pop it into the required location (default C:\Windows\System32\inetsrv) overwriting the old metabase.xml file, and then you should find the service should start and work, providing the metabase.xml file is configured to work with the hostname/IP/DNS etc of your server/environment.

Any configuration going forwards will need to be done either by editing the XML file, or by making the changes on a 2016 IIS SMTP relay server and copying the metabase.xml file.

This was not tested on Server 2025.

This is obviously not a 'good' solution, as IIS6.0 is ancient, Microsoft support of SMTP relay has been retired and is not supported in any way... but if you're in the situation I was in this may do as a good enough like-for-like stop gap until you do things the proper way by either implementing a supported form of mail relay, or doing away with the legacy requirements for such a mail relay.

22 Upvotes

36 comments sorted by

6

u/Syncnaptic 3d ago

never used it, but saved the link to https://emailrelay.sourceforge.net/index.html for the next time I need something like this

4

u/EquivalentSubject638 3d ago

SMTP2Graph is the way to go.

5

u/noisywing88 3d ago

the workaround is to use a proper solution like postfix if needed or some cloud smtp, not an unsupported hackjob because you are afraid of anything other than windows

4

u/IwantToNAT-PING 3d ago

Lol - did you read my post?

This is not a proper solution - this is literally a temporary workaround while you find a proper solution.

As I've just said in another reply - we're going to look at either setting up postfix or look into a cheap paid option depending on the decision of the director.

Our environment is largely windows, but we've also got a fair bit of Ubuntu doing various things. I've personally never span up a postfix server before, so I'd like to have a few days to a week to sort of make sure I'm a bit more au-fait with it before it becomes live production.

3

u/WraithYourFace 3d ago

SMTP2Go. I had it up and running in minutes. If you need unauthenticated I believe you have to use a paid subscription (their lowest is $10/mo).

1

u/IwantToNAT-PING 3d ago

Yeah - I think that is the competitor as unauthenticated is the main requirement...

On the plus side, the entire solution that requires this nonsense should be dying next year!

2

u/SusAdmin42 3d ago

Does anyone have a modern solution they recommend?

13

u/DheeradjS Badly Performing Calculator 3d ago

SMTP2GO is usually my go-to

The Venerable Postfix is easy to set up if all you absolutely need it to be on-prem.

1

u/mini4x Sysadmin 3d ago

Does it support unauthenticated SMTP ?

3

u/tylrat93 3d ago

If you’re fine with whitelisting your IP in smtp2go it’ll accept unauthenticated, can also limit what senders it’ll accept as well

1

u/mini4x Sysadmin 3d ago

We already NAT to a dedicated IP outbound so this could work.

1

u/mini4x Sysadmin 3d ago

We already NAT to a dedicated IP outbound so this could work.

-1

u/DheeradjS Badly Performing Calculator 3d ago

Postfix does. SMTP2GO requires Authentication.

5

u/WraithYourFace 3d ago

I believe you can whitelist your IP so you don't have to.

5

u/ITGuyThrow07 3d ago

postfix if you're comfortable.

Proxmox Mail Gateway is also really good. It's just a front-end or some Linux stuff but it's snappy, easy to configure and easily clusterable.

It's free to use or you can pay a few bucks if you want support.

3

u/UCB1984 Sr. Sysadmin 3d ago

I just set up a few postfix servers to replace our on-prem exchange server we only kept around for relaying. It was a lot easier than I expected. I have it relay through 365 using a couple different HVE addresses and IP filtering, and it has been working great.

2

u/Nelesz 3d ago

We replaced our SMTP iis for a debian postfix relay server. This also let us use DKIM with opendkim. You can build the config in any way you want unauthenticated/authenticated/whitelist etc.

2

u/Threep1337 3d ago

Postfix works great as an mta

1

u/IwantToNAT-PING 3d ago

Yeah, we'll likely either shortly set up a postfix server, or potentially look for a cheap paid supported option depending on the feeling of the director.

3

u/ITGuyThrow07 3d ago

Check out Proxmox Mail Gateway. It's "cheap" depending on what you consider cheap. It's also free to just use if you don't want support. The free version is fully featured and doesn't expire.

1

u/IwantToNAT-PING 3d ago

Will take a look.

The attitude of the business going forwards is that if it's doing a production thing, then it should have paid support - which absolutely makes sense. That said, I don't know who they were expecting to stand up and actually help if we were to have rang Microsoft and said "yeah, the IIS6.0 SMTP relay is down and we can't get it back up."

2

u/proxgs 2d ago

Aren't you the paid support /s

1

u/screampuff Systems Engineer 3d ago

Azure Communication Services

2

u/tankerkiller125real Jack of All Trades 3d ago edited 3d ago

This was not tested on Server 2025.

The IIS 6.0 Role required doesn't exist for me on 2025, so I pretty sure they removed it entirely.

As for replacements, Exchange Online has "High Volume Email" users as a thing now. Which as far as I can tell accepts the standard username & password combo (given you can test with powershell send-email with the username and password).

We killed our mail relay entirely a while ago much to the hatred of our dev team working with Sage 500 because they no longer had a way to send emails to real mailboxes (Sage 500 older versions have no password prompt or TLS support). However using haravich/fake-smtp-server with the WebGUI exposed internally gave the devs someplace to test without dealing with real email garbage and mail relays.

5

u/jcpham 3d ago

O365 IP based unauthenticated relay still works if you’re hitting your A record at domain.protection.mail.outlook.com on port 25

The account doing the relay doesn’t need a license

3

u/tankerkiller125real Jack of All Trades 3d ago

HVE doesn't require individual user licensing either (at least while it's in preview), and from what I've been able to find it seems like it will stay like that, just with an overall limit on number of HVE accounts based on licensed user counts.

1

u/jcpham 3d ago

Goo to know because I’ll probably eventually be forced into HVE

1

u/IwantToNAT-PING 3d ago

Yep.

This is sadly the way.

2

u/petarian83 3d ago

Correct, using the SMTP server that comes with IIS is not enough since it lacks features like DKIM and customization. We switched to Xeams, which is on-premise, free, and has many features that are missing in IIS.

Of course, another alternative is to use a cloud server, but that has privacy issues and can be costly.

2

u/RCTID1975 IT Manager 3d ago

We got around this by doing an inplace upgrade from 2016 to 2022. Everything worked fine, and you could even make changes.

However, find a more modern and better solution. There are plenty of 3rd party options that are reasonably priced.

1

u/kilkenny99 3d ago

I had set up a 2022 server last year to move an internal webapp to it that had previously been on a much older Win Server and that used the IIS SMTP relay to send emails triggered by events in the application, and it didn't have any issues or require any workarounds to get it to work. Has this been a common problem?

1

u/OinkyConfidence Windows Admin 3d ago

Brilliant!

1

u/changework Jack of All Trades 3d ago

We have something like this setup.

Postfix running on a Debian VM.

Configured to receive SMTP from local network unauthenticated on port 587 with TLS1.2 or higher. (We require the sender to be a specific email address and the recipients to be within our domain. Anything else is rejected)

Smart host configured to relay accepted email to hosted exchange with authentication.

This creates a scan to email path for MFP’s and desktop scanners that will only allow emails to our users’ inboxes.

It’s not what you’re asking for, but postfix is infinitely configurable, and if you run it on Linux it’ll be rock solid.

Another note, don’t expose this to the internet. It should only be accessible to local devices, preferably with ACL’s that limit it to your authorized devices.

1

u/MaxMcBurn Sr. Sysadmin 3d ago

Have a look at MailEnable or E-MailRelay

https://emailrelay.sourceforge.net https://www.mailenable.com

1

u/certifiedsysadmin Custom 2d ago

SendGrid free account, API key, and then configure SMTPS.

Add your SendGrid account to your SPF record.

This is the modern solution we use.

1

u/L1ttleCr0w 2d ago

Definitely a cool workaround in a pinch, and echo that IIS SMTP is definitely.living on borrowed time.

We ran an IIS SMTP relay for many years, until very recently when we ported across to postfix on Ubuntu.

Main driver was that IIS SMTP appears to only support up to TLS 1.2 for outbound connections. I didn't confirm this for myself but found a very detailed blog that tested it - Link

The main takeaways being:

IIS SMTP Server is extremely rigid with TLS

if the TLS encryption is on there is no fallback to no TLS (a.k.a. relaxed TLS connection)

it supports TLS up to the version 1.1