SMTP Relay: Send App Email Through Your Own Server

Short answer. An SMTP relay is a mail server that accepts email from your apps, websites and devices and delivers it to recipients. Your app connects on port 587 (STARTTLS) or 465 (TLS), logs in, and hands the message over; the relay does the rest: DNS lookups, DKIM signing, retries and delivery. You can rent one (SendGrid, Mailgun, Amazon SES and others) or run your own. A hosted relay is the better choice for high-volume marketing email or if you can’t run a server. Your own mail server is the better choice if you already self-host email, mostly send transactional mail, and want a flat cost and control over your data.

Hosted relay or your own: how to decide

	Hosted SMTP relay	Your own mail server as the relay
Cost	Free tier, then per message or per plan	Flat: the server (a small VPS), no per-message fees
Setup	Sign up, add DNS records, get credentials	Install a mail server, add DNS records, create a sending mailbox
Sending IP	Shared or dedicated IPs the provider manages	Your server’s IP: you build and keep its reputation
Best for	Marketing blasts, very high volume, no server to run	Receipts, password resets, notifications, website forms, internal alerts
Port 25	Not needed on your side	Must be open outbound on your server
Message data	Passes through and is logged by the provider	Stays on infrastructure you control
Receiving mail	Usually not included	Same server handles your mailboxes

The honest rule: if bulk or cold marketing email is core to your business, use a provider with a managed IP pool. Reputation for those sending patterns is fragile, and it’s worth paying someone to manage it. For everything else, including the email your product itself sends, your own server is usually simpler and cheaper, especially if you’d be running one for your team’s mailboxes anyway.

How to send through your own server

With Vectis Mail, any mailbox can send authenticated mail, so an app or device just needs a mailbox of its own.

1. Create a dedicated sending mailbox, such as [email protected] or [email protected]. Keep it separate from people’s mailboxes so you can rotate its password or suspend it without affecting anyone.
2. Use these settings in your app or device:

Setting	Value
SMTP host	your mail hostname, e.g. mail.example.com
Port	587 (STARTTLS) or 465 (SSL/TLS)
Encryption	Required: TLS 1.2 or newer
Authentication	Username = the full mailbox address; password = its password
From address	The sending mailbox’s address

3. Send a test and check the headers at the receiving end: spf=pass, dkim=pass and dmarc=pass mean everything lines up.

For example, from Python:

import smtplib, ssl
from email.message import EmailMessage

msg = EmailMessage()
msg["From"] = "[email protected]"
msg["To"] = "[email protected]"
msg["Subject"] = "Your receipt"
msg.set_content("Thanks for your order.")

with smtplib.SMTP("mail.example.com", 587) as s:
    s.starttls(context=ssl.create_default_context())
    s.login("[email protected]", "the-mailbox-password")
    s.send_message(msg)

Most frameworks and CMSs (Laravel, Django, Rails, Node’s Nodemailer, WordPress SMTP plugins) take the same five settings.

Or skip SMTP and use the API

If your app can make an HTTPS request, Vectis Mail’s sending API is often easier than SMTP: one POST per message, API keys that can be limited to specific domains, and webhooks for delivery and bounce events. It sends through the same server, with the same DKIM signing and the same reputation.

What protects you when you run the relay

A relay you run is only as good as its safeguards. These are built into Vectis Mail:

• No open relay. Port 25 is for receiving mail from other servers. It doesn’t accept logins, and it won’t relay mail for anyone who isn’t authenticated.
• TLS required for sending. Ports 587 and 465 require encryption, with TLS 1.2 as the minimum.
• Sending limits. Per-mailbox and per-domain hourly sending rates are tracked, and a mailbox that exceeds its limit is suspended automatically, so a leaked app password can’t burn your reputation overnight. Sudden spikes raise an alert.
• IP warmup. A new server’s IP has no reputation yet. During warmup, sends over the day’s allowance are deferred with a temporary 452 4.5.3 reply, which apps and SMTP clients retry later, instead of being sent too fast. See the IP warmup guide.
• DKIM signing and DMARC for every domain, set up when you add the domain. See DKIM, SPF and DMARC.

“Relay access denied”: what it means and how to fix it

554 5.7.1 <[email protected]>: Relay access denied is the most common error when pointing an app at a mail server. The server is refusing to pass your message on to another domain because it doesn’t recognise you as someone allowed to send through it. That refusal is deliberate: a server that relays for anyone becomes a spam cannon within hours.

Work through these in order:

1. Port. Port 25 is for server-to-server delivery, and Vectis Mail (like any well-configured server) won’t relay for clients there. Use 587 with STARTTLS or 465 with TLS.
2. Authentication. Make sure the app is actually logging in: SMTP authentication switched on, username set to the full mailbox address, and the right password. Some plugins and devices keep authentication off by default.
3. Encryption. Vectis Mail only accepts logins over TLS. An app set to “no encryption” never gets as far as logging in, then tries to send anyway.
4. The right server. Check the SMTP host is your own mail server, not your domain’s website host or an old provider’s server that no longer handles your domain.

If the error persists, the server’s log shows whether the connection logged in at all, which tells you whether the problem is the credentials or the connection settings.

Devices: printers, scanners and appliances

Scan-to-email and appliance alerts work through your own server if the device supports SMTP authentication and TLS 1.2+ on port 587 or 465. Older devices are the usual problem: some only speak TLS 1.0 or expect to send unauthenticated on port 25. For those, update the firmware if you can. Otherwise put a small relay on your local network that accepts the device’s mail and forwards it to your server over an authenticated, encrypted connection.

Before you switch

• Open outbound port 25 on your server. Many VPS providers block it by default and lift it on request.
• Set reverse DNS (PTR) for your server’s IP to match your mail hostname.
• Publish SPF, DKIM and DMARC for each sending domain.
• Warm up a new IP before moving large volumes onto it.
• Keep bulk marketing separate. If you also send newsletters at scale, keep that on a dedicated provider so it can’t affect the reputation your transactional mail depends on.

If you’re weighing this against a hosted provider, our SendGrid and Postmark comparisons go into the trade-offs in more detail, and the deliverability guide covers what decides inbox placement for any sender.