Email security & monitoring
Send a Test Email over SMTP
Send a test email from PowerShell three ways: authenticated SMTP (TLS on port 587), an unauthenticated internal relay, or direct to a Microsoft 365 mail connector (the MX endpoint on port 25). Includes an MX-lookup helper. Handy for confirming a mail relay works and for security and relay testing.
Replace generic placeholder values (tenant, domain, secrets) for your own environment before running. Read it first and test safely.
<#
.SYNOPSIS
Send a test email from PowerShell over SMTP: authenticated, unauthenticated
relay, or direct to a Microsoft 365 mail connector. Handy for confirming a mail
relay is working and for security / relay testing.
.DESCRIPTION
Three common ways to send mail via SMTP, plus a helper to look up a domain's MX
(receiving mail host). Set the values in the config block, then use the method
that matches your setup. Methods 2 and 3 are commented out; uncomment the one you want.
.NOTES
Send-MailMessage is officially deprecated by Microsoft (it still works, but is not
recommended for production automation). It is fine for the quick relay / security
tests this script is for. Only send test mail through relays you own or are
authorised to test.
#>
# ---------------------------------------------------------------------------
# Configure for your environment
# ---------------------------------------------------------------------------
$from = '[email protected]'
$to = '[email protected]'
$sub = 'Test email'
$body = 'Test email sent from PowerShell.'
# ---------------------------------------------------------------------------
# 0. Find the MX / mail relay endpoint for a domain
# ---------------------------------------------------------------------------
# The MX record is the domain's receiving mail host. For Microsoft 365 it looks like
# yourdomain-com.mail.protection.outlook.com (used by Method 3 below).
Resolve-DnsName -Name 'yourdomain.com' -Type MX | Select-Object NameExchange, Preference
# ---------------------------------------------------------------------------
# 1. Authenticated SMTP submission (e.g. a mailbox, TLS on port 587)
# ---------------------------------------------------------------------------
$smtp = 'smtp.yourprovider.com'
$password = '<YOUR_PASSWORD>' # better: use Get-Credential rather than a plaintext password
$Credentials = New-Object System.Management.Automation.PSCredential(
$from, (ConvertTo-SecureString $password -AsPlainText -Force))
Send-MailMessage -To $to -From $from -Subject $sub -Body $body `
-SmtpServer $smtp -Credential $Credentials -UseSsl -Port 587
# ---------------------------------------------------------------------------
# 2. Unauthenticated relay (an internal SMTP relay that allows your IP)
# ---------------------------------------------------------------------------
# $smtp = 'relay.yourdomain.com'
# Send-MailMessage -To $to -From $from -Subject $sub -Body $body -SmtpServer $smtp
# ---------------------------------------------------------------------------
# 3. Direct to a Microsoft 365 connector (MX endpoint, port 25, no auth)
# ---------------------------------------------------------------------------
# Sends straight to the M365 mail host. Works when a connector / allowed-sender IP
# is configured for your tenant (a common pattern for app and device relay).
# $smtp = 'yourdomain-com.mail.protection.outlook.com'
# Send-MailMessage -To $to -From $from -Subject $sub -Body $body -SmtpServer $smtp -Port 25