> For the complete documentation index, see [llms.txt](https://docs.sendman.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sendman.com/admin-portal/settings/smtp-backend.md).
# SMTP Backend
Configure the mail server Sendman delivers to, and how Sendman authenticates there
## Overview
The **SMTP backend** is the mail server Sendman relays accepted messages to, for example Exchange Online. On this page, you configure its address and how Sendman identifies itself there: with a username and password, a client certificate, or both.
{% hint style="info" %}
Changes apply to new connections. Stored passwords are never displayed; leave a password field empty to keep the stored password.
{% endhint %}
For Exchange Online, follow the [Exchange Online guide](/configuration/get-started/scenario-based-guides/exchange-online.md).
## Server
| Field | Description |
| ------------------ | -------------------------------------------------------- |
| **Server address** | Host name of your mail server, e.g. `smtp.office365.com` |
| **Port** | Usually `587` or `25` |
Sendman connects to the mail server with SMTP and encrypts the connection with **STARTTLS** whenever the server offers it. Mail servers that only accept implicit TLS (SMTPS, usually port 465) are not supported.
{% hint style="warning" %}
**Remove server settings** deletes the server address and port. Sendman then cannot relay mail and answers every connection with `421 Service not available` until a server is configured again.
{% endhint %}
## Credentials
| Field | Description |
| ------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------- |
| **Authenticate at the backend with these credentials** | When on, Sendman signs in with the username and password below whenever the mail server offers authentication. Sendman uses AUTH LOGIN. |
| **Username** | The account Sendman signs in with, e.g. `sendman@contoso.com` |
| **Password** | The password of this account. It is stored encrypted and never displayed again. |
Click **Save backend settings** to save the server and the credentials. **Remove credentials** deletes username and password.
Switch **Authenticate at the backend with these credentials** off if your mail server identifies Sendman otherwise:
* by its [client certificate](#client-certificate), or
* by its source IP address, e.g. with the [dedicated egress gateways](/admin-portal/settings/network-connections.md#sendman-egress).
{% hint style="warning" %}
If backend authentication is off and no client certificate is used, nothing identifies Sendman to the mail server. This only works if the mail server trusts Sendman by its source address.
{% endhint %}
## Client certificate
Some mail servers identify Sendman by a client certificate (mutual TLS), for example an [Exchange Online connector](/configuration/get-started/scenario-based-guides/exchange-online.md#identify-sendman-by-certificate). Sendman then presents the certificate when it upgrades the connection to the mail server with STARTTLS.
### Upload
1. Under **Client certificate**, select the **PFX file**: a PKCS#12 file (`.pfx` or `.p12`) with the certificate and its private key, at most 64 KB. Include the intermediate CA certificate if your mail server needs it.
2. Enter the **PFX password**, or leave it empty for a file without password.
3. Click **Upload certificate**.
4. Switch on **Use the client certificate for mutual TLS**.
The card shows the certificate's **Subject**, **Issuer**, **Thumbprint**, **Valid until** and when it was **Uploaded**. A badge warns when the certificate **Expires soon** (less than 30 days) or has **Expired**.
{% hint style="info" %}
The client certificate does not replace the credentials. Sendman still signs in with username and password unless **Authenticate at the backend with these credentials** is switched off.
{% endhint %}
### Replace
Before the certificate expires, upload the renewed certificate with **Replace certificate**. The new certificate is used for new connections immediately.
### Remove
**Remove certificate** deletes the certificate and switches mutual TLS off. Sendman then connects to the mail server without a client certificate.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.sendman.com/admin-portal/settings/smtp-backend.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
