Exchange mail flow guides › Outbound: send connectors and smart hosts
Using IONOS, Strato or GMX as the smart host for Exchange: why the sender must match the login, and how to send several domains anyway
A provider mailbox used as the smart host for Exchange is an authenticated SMTP account, and IONOS documents that since January 2024 its outgoing mail servers accept a message only when the sender address is in the same domain as the mailbox used for the login; a message with another sender, or with no sender at all, is refused with Sender address is not allowed. An Exchange Server that sends several domains through one provider login therefore gets every other domain rejected, and its non-delivery reports and out-of-office replies with it. The fix is one authenticated relay session per sender domain, which Exchange cannot do on its own: it authenticates a send connector with one login for everyone.
Updated on 2026-09-18
The setup that breaks
Many small Exchange installations do not deliver outbound mail themselves. The send connector points at the provider’s outgoing mail server as a smart host, authenticates with the credentials of one mailbox there, and the provider takes care of DNS, reputation and TLS towards the world. That works as long as every sender in Exchange writes from the domain of that one mailbox. It stops working the moment a second domain is added to Exchange, a user replies from an alias in another domain, or Exchange itself sends a message with an empty sender. The provider sees a sender it does not own behind the login it authenticated, and rejects the message at the MAIL FROM step of the SMTP session. Exchange keeps the message in its queue with the provider’s error text, and the sender learns about it from a delayed-delivery notification, if at all.
What IONOS enforces, in its own words
IONOS describes the change on its help page Wichtige Änderung für das Versenden von E-Mails mit abweichender Absenderadresse (German), and our knowledge base records the effect on Exchange in IONOS blocks non-delivery reports and out-of-office messages:
| Rule | What it means for Exchange | Source |
|---|---|---|
| Sender domain must equal the login mailbox domain | Since 29 January 2024 the outgoing servers for Mail Basic and Mail Business refuse alternative sender addresses. The local part before the @ may differ; the domain after it may not. Each Exchange domain needs a login in that domain. | IONOS help page |
| Empty sender addresses are refused | Non-delivery reports and out-of-office replies leave Exchange with an empty envelope sender and are rejected with Sender address is not allowed. Not configurable in Exchange. | IONOS help page, knowledge base |
| Applies to mail servers and relays, not only to mail clients | IONOS names Outlook, mobile apps and server applications such as Microsoft 365/Exchange and Open-Xchange alike, and states that alternative sender addresses are not possible on IONOS Microsoft Exchange either. | IONOS help page |
| A relay needs a mailbox plus an SPF record in the same domain | The section for SMTP relay servers and smart hosts asks for a relay mailbox address and an IONOS SPF entry for that domain. | IONOS help page |
What about Strato, GMX and the others?
We document what we can verify. For Strato the knowledge base holds one fact: the Strato outgoing servers have required SMTP authentication since September 2008 (knowledge base, German), so an unauthenticated send connector fails there with 530 SMTP authentication is required. Which sender addresses Strato, GMX or web.de accept behind a login is published on their own help pages and is not reproduced here; check the page for your product before you rely on it. The symptom class is the same whatever the wording: a permanent error at MAIL FROM that names the sender address, for exactly the messages whose sender is not the login. The relay setup below fixes that class, because it makes every session use the login that owns the sender.
Symptom, cause, fix
| What you see | Cause | Fix |
|---|---|---|
| Sender address is not allowed in the Exchange queue, only for the second domain | The send connector authenticates with the first domain’s mailbox for every sender | One relay account per sender domain, each with that domain’s login |
| External senders never receive your non-delivery reports or out-of-office replies | Empty envelope sender, rejected by the provider | A relay that replaces the empty sender; the LITE edition is enough |
| Sending works from Outlook with the provider account, but not from Exchange | Outlook logs in as the mailbox that owns the address; Exchange uses one connector login for all | Same as the first row: the login must follow the sender |
| 530 SMTP authentication is required | The connector sends without credentials to a server that demands them | Add the login to the connector or to the relay account (knowledge base) |
Fix A: stay with one domain
If Exchange really sends only one domain, keep the send connector as it is, authenticate it with a mailbox in that domain and make sure no user has a reply address elsewhere. What remains is the empty-sender case: Exchange offers no setting that puts an address into the envelope of a non-delivery report or an out-of-office reply, so external senders will not get them through IONOS unless something between Exchange and the provider fills the sender in. That is the single-account job the free MultiSendcon LITE edition does.
Fix B: one relay session per sender domain
Exchange chooses a send connector by recipient domain and cost, never by sender (see why send connectors cannot route by sender), so the per-sender decision has to happen in front of the provider. MultiSendcon runs as a Windows service on the Exchange server, receives everything through one send connector and matches the sender address against its relay accounts:
- Install. Download MultiSendcon and run the installer on the Exchange server. It creates the send connector that hands outbound mail to the service; if PowerShell remoting is disabled, one command creates it manually (knowledge base).
- One SMTP account per domain. Under Relay servers add an SMTP account for each provider login: server, port (25, 587 or 465; SSL is switched on automatically with 465), user name and password, and the sender filter
*@company-a.com. Repeat for*@company-b.comwith the login that owns that domain, even when both live at the same provider. - Fill the empty sender. In each account, set the fixed sender address replacement so that messages without a sender leave with an address the provider accepts; where the message header names a sender, that address is used instead of the fixed one.
- Test. Run the account test with a From address that matches each sender filter and read the reply in the Administrator log.
- Switch Exchange over. Lower the cost of the MultiSendcon send connector from 100 to 1 so it wins over the old provider connector, then disable the old one. From now on each domain reaches the provider through its own login, and senders that match no account fall through to the Master Relay.
Accounts are matched top to bottom, so a single address can sit above its domain rule, and two accounts with the same filter act as primary and fallback. The step-by-step guide for multiple smart hosts shows the same setup next to the native per-recipient-domain configuration.
Next steps
- Two domains at IONOS: create the second mailbox, then install the trial and add two accounts with the two logins and sender filters.
- One domain, but missing non-delivery reports: the LITE edition included in the same download is enough; set one account with the fixed sender.
- Not sure what the provider rejects: run the account test and read the exact server reply in the log before changing Exchange.
Frequently asked questions
Can I keep sending from an address in another domain through my IONOS login?
Not through IONOS Mail Basic or Mail Business: since January 2024 the part of the sender address after the @ must be the same domain as the mailbox used for the SMTP login, and IONOS also states that alternative sender addresses are not possible on its hosted Microsoft Exchange. The part before the @ stays free. For every additional domain you need a login that belongs to that domain, and something in front of the provider that picks the right login per sender.
Why do my non-delivery reports and out-of-office replies never reach external senders?
Exchange sends both with an empty envelope sender (an empty MAIL FROM), exactly as the SMTP standard requires, and IONOS rejects messages with an empty sender since January 2024. Nothing in Exchange changes this behaviour. A relay between Exchange and the provider can fill the empty sender with the address from the message header, or with a fixed address configured for the account, and the message is then accepted.
Is the free MultiSendcon LITE edition enough?
For one provider login it is: LITE handles a single relay account and replaces the empty sender, which is the whole fix for the non-delivery-report and out-of-office case. It has no per-sender routing, so as soon as two domains must leave through two different logins you need the full edition with one SMTP account per sender domain.
Which port and encryption should the relay account use?
The account settings accept port 25, 587 or 465; with port 465 the encrypted connection is switched on automatically. Use the port and the login your provider publishes for its outgoing mail server, then run the built-in account test with a sender address that matches the account's sender filter before you switch the Exchange send connector over.
More on outbound mail flow in the Exchange mail flow guides, or in the knowledge base. Auf Deutsch: IONOS, Strato oder GMX als Smarthost für Exchange.