Hardening Local SMTP Relays: Solving Microsoft 365 SendAs Rejections and Multi-VLAN Scoping

In modern hybrid MSP and homelab environments, internal appliances, hypervisors, and alert platforms (such as Tactical RMM, Zabbix, Vaultwarden, and Proxmox/XCP-ng) require a lightweight, unauthenticated local SMTP relay to dispatch notification emails without exposing cloud credentials to every individual container or device.

The Challenge: Exchange Online SendAs Rejections & Network Scoping

During an infrastructure health check on our local Postfix relay container (10.1.20.18:25 on srv-docker-02), two critical failure modes were identified:

• VLAN Subnet Boundary Mismatch: The relay’s mynetworks configuration permitted server VLAN 20 (10.1.20.0/24) and management VLAN 1, but rejected workstations on VLAN 10 (10.1.10.0/24) with 554 5.7.1 Client host rejected: Access denied.
• Microsoft 365 SendAs Denials: While the relay successfully authenticated outbound to smtp.office365.com:587 as [email protected], notification engines sending alerts as [email protected] (Tactical RMM) or [email protected] were rejected by Exchange Online with 554 5.2.252 SendAsDenied.

Architecture & Implementation

To eliminate these bottlenecks without compromising M365 security or requiring manual alias assignments for every new service, we implemented a three-tier remediation:

1. Subnet CIDR Expansion

In the Docker Compose stack (/opt/stacks/mailrelay/compose.yml), we expanded the trusted network declaration to encompass all internal subnets:

POSTFIX_mynetworks: "127.0.0.0/8 10.1.0.0/16 172.16.0.0/12"

2. Postfix Sender Canonical Address Rewriting

To satisfy Exchange Online’s strict envelope validation while preserving human-friendly sender display names (e.g. Tactical RMM Alerts), we mounted a regex canonical mapping file:

# /opt/stacks/mailrelay/sender_canonical
/^(.*)@.*$/ [email protected]

And configured Postfix to enforce rewriting across all internal clients:

POSTFIX_sender_canonical_maps: "regexp:/etc/postfix/sender_canonical"
POSTFIX_sender_canonical_classes: "envelope_sender,header_sender"
POSTFIX_local_header_rewrite_clients: "static:all"

3. Cloudflare Authoritative SPF Alignment

Via the Cloudflare API, we updated the public SPF TXT record for ittechstl.com to authorize outbound submission from our primary WAN IP (99.108.117.133), ensuring full alignment with strict DMARC quarantine policies:

v=spf1 include:spf.protection.outlook.com include:sendgrid.net +ip4:168.245.102.208 +ip4:99.108.117.133 ~all

Live Verification Results

End-to-end dispatch tests confirmed immediate queue clearance and delivery:

postfix/smtp: CA4D8CCC7F: to=<[email protected]>, relay=smtp.office365.com:587, status=sent (250 2.0.0 OK)
postfix/smtp: B47B7CE95E: to=<[email protected]>, relay=smtp.office365.com:587, status=sent (250 2.0.0 OK)

All internal homelab alerts and MSP monitoring notifications are now flowing cleanly across all VLANs with zero authentication friction.