Exchange Mail Flow Guides

These guides answer the questions Exchange administrators ask about getting mail into and out of an on-premises Exchange Server: POP3/IMAP retrieval, send connectors and smart hosts, sender addresses in Outlook, and OAuth2 for Microsoft 365 and Gmail.

Each guide opens with the direct answer, cites Microsoft Learn wherever we rely on Microsoft’s documented behaviour, and points to a product only where a product is part of the answer. Guides are added one at a time. Until a guide exists for a question, the lists below point to the pages that already cover it.

Updated on 2026-09-12

Inbound: POP3 and IMAP retrieval into Exchange

Getting mail that arrives in provider mailboxes (IONOS, Strato, GMX, Gmail, Microsoft 365) into on-premises Exchange mailboxes, and the questions that follow once it works.

• Does Exchange Server have a built-in POP3 connector? — the POP3 service vs a POP3 connector, why only SBS 2008/2011 had one, and what replaces it on Exchange 2013 to SE.
• The SBS 2008/2011 POP3 Connector: what it did, its limits, and the replacement — feature-by-feature comparison with a current connector and the migration steps when you leave SBS.
• How to download POP3 and IMAP mailboxes into Exchange 2016, 2019 and SE — the four steps: accepted domain, receive connector, connector accounts, first test, plus the errors a fresh setup runs into.
• Catch-all (multidrop) mailbox vs one POP3 mailbox per user — which routes correctly, where BCC and mailing lists break, what happens to unknown recipients, and how to mix both.
• POP3 or IMAP for retrieving provider mailboxes into Exchange? Ports, TLS, leave-on-server and OAuth2 — the two protocols as a connector uses them, why the encryption setting must match the port (TLS on 995/993, STARTTLS on 110/143), the delete / leave-on-server options, and where Microsoft 365 and Gmail decide for IMAP.
• POP3 retrieval or MX record to Exchange: when a connector is the right choice and when it is not — what direct SMTP delivery requires (public DNS, inbound port 25, your own spam filtering), what happens to mail while Exchange is down in either design, and the order in which to switch from retrieval to the MX record.
• Where to install a POP3/IMAP connector: on the Exchange server, a member server, or a workstation — what the connector needs at every placement (outbound POP3/IMAP, SMTP to one receive connector), how the three placements differ in firewall path, receive connector scope and antivirus exclusions, and the checks when it downloads fine but cannot reach Exchange.
• Exchange Server SE (Subscription Edition) and POP3/IMAP mailbox retrieval: what changes, what does not — SE RTM is code equivalent to Exchange 2019 CU15 and still has no built-in POP3 connector; what to check on the connector after an in-place upgrade, and the order of work when Exchange 2016 or 2013 means a new server.
• POP3/IMAP over TLS for mail retrieval: ports 995 and 993, STARTTLS vs implicit TLS, and “-ERR Command is not valid in this state” — implicit TLS on 995/993 vs STARTTLS on 110/143 as Microsoft documents them for Exchange Server and Exchange Online, what Microsoft 365 and Gmail expect, why STLS on port 995 is refused, the four encryption values in the connector, TLS versions, and the SMTP twins 504 5.7.4 and 530 5.7.0.
• Antispam and antivirus for POP3/IMAP-collected mail before it reaches Exchange: RBL checks, tagging, quarantine — why Exchange’s connection filtering never sees the original sender of connector-delivered mail, how DNS blacklist checks work and why they are slow when DNS is broken, tag vs divert vs delete, the whitelist, and the virus path before and after SMTP submission.
• Exchange POP3 connector — what a POP3/IMAP connector does and which Exchange versions it serves.
• Configure Exchange 2013 / 2016 to receive mail from POPcon — the receive-connector setup; guides for Exchange 2010, 2007 and 2003 sit beside it.
• Which Exchange versions and SBS editions does POPcon work with?
• Why does a connector need to know the accepted domains? — the catch-all mailbox question.
• Mailing-list mail is not distributed correctly and BCC recipients do not receive the email — the two classic catch-all follow-ups.
• Only messages under 10 MB come through and how to raise the Exchange size limit.
• Non-delivery reports for unknown users behind a POP3 connector.
• Could not reach Exchange SMTP server — port 25 blocked.

Outbound: send connectors and smart hosts

Routing outgoing mail from Exchange through provider relays, including several smart hosts and authentication per sender.

• Exchange send connectors route by recipient domain, not sender — how to route outbound mail by sender address anyway — how connector selection works, why two * connectors do not help, and the three options that do.
• Multiple smart hosts in Exchange 2016/2019: per recipient domain (built in) and per sender (with a relay) — both setups step by step, the commands to verify them, and a comparison table.
• Using IONOS, Strato or GMX as the smart host for Exchange: why the sender must match the login — what IONOS enforces since January 2024 (sender domain = login mailbox, no empty sender), the symptom table, and one relay session per sender domain.
• Exchange: “A matching connector cannot be found to route the external recipient” — causes and fix — why mail lands in the Unreachable queue, the five connector settings behind it, and the commands to check and resubmit.
• Hosting several companies or domains on one Exchange Server — accepted domains and email address policies per company inbound, one provider relay and login per sender domain outbound, a worked example with two providers, and what stays shared.
• Multiple send connectors for Exchange — routing by sender address to different smart hosts.
• Creating the send connector in Exchange manually.
• 504 5.7.4 Unrecognized authentication type — when relaying through the Office 365 SMTP servers fails.
• IONOS blocks non-delivery reports and out-of-office messages — the empty-sender rule at the IONOS relay.

Sender address in Outlook

Letting Outlook users choose the From address per message on Exchange on-premises, and keeping that choice under control.

• How Outlook users can choose a different From address on Exchange on-premises — Send As, Send on Behalf, a shared mailbox or an add-in, compared.
• Send As vs Send on Behalf vs sending from an alias — the three terms defined, what the recipient sees, where replies land, and why alias sending exists only in Exchange Online.
• Change the sender address in Outlook — per-message sender selection for Exchange users.
• Using the same sender address for two Exchange mailboxes.
• Restricting which Send-As addresses users may choose.

Authentication and SMTP errors

Modern authentication for the mailboxes a connector reads, and the SMTP responses Exchange returns when a connector submits mail.

• Basic authentication is gone: fetching a Microsoft 365 mailbox by IMAP or POP3 with OAuth2 into Exchange — what Microsoft switched off, how a service keeps a token alive without a password, the seven setup steps, and the symptoms behind “the password is correct but it keeps asking”.
• Fetching Gmail and Google Workspace mail into Exchange over IMAP with OAuth2 — what Google switched off for Workspace and personal accounts, why an app password is not the answer, the eight setup steps on imap.gmail.com port 993, and IMAP vs POP3 at Google.
• Exchange SMTP error codes explained: 421 4.4.1, 421 4.4.2, 451 4.7.0, 452 4.3.1, 530 5.7.1, 550 5.7.1 and more — every reply a connector sees when it submits mail to Exchange, in one table per class: what it means, the usual cause, the fix and the knowledge base article with the commands.
• “550 5.7.1 Unable to relay” when a connector submits to Exchange — what Exchange checks before it refuses a recipient, why the missing accepted domain is the usual cause, which receive connector answers, and Microsoft’s dedicated relay connector for hosts that must send to external recipients.
• Messages over 10 MB are not arriving: size limits between the POP3 connector and Exchange — the organization, receive connector and mailbox limits with Microsoft’s defaults, which one stops connector mail and whether the sender is told, and how to raise them and resend what waits in the TOOLARGE folder.
• NDRs for external senders behind a POP3 connector — unknown recipients, oversized mail and out-of-office replies: when Exchange generates the non-delivery report, when the message goes to the postmaster or stays in the queue instead, and why a provider that refuses empty senders stops the report on its way out.
• OAuth2 for Microsoft 365 and Outlook.com mailboxes — the walkthrough with screenshots.
• Gmail with modern authentication (OAuth2).
• 530 5.7.0 Must issue a STARTTLS command first.
• 530 SMTP authentication is required.
• 550 5.7.1 Unable to relay.
• 421 4.4.2 Message submission rate exceeded.
• 421 4.4.1 Connection timed out.
• 452 4.3.1 Insufficient system resources.
• 451 4.7.0 Temporary server error (PRX).

Everything else is in the knowledge base. If your question is not covered, ask support — unanswered questions are how the next guide gets chosen.