'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Fix Postfix SASL Authentication Fails with Microsoft 365 Error 535 5.7.139
Question details
The user needs to fix a Postfix mail server authentication failure to Microsoft 365 after tenant security policies were updated.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Attempting to send email through Microsoft 365 using a Postfix mail server after Security Defaults have been enabled for the tenant.
- Observed behavior
- Postfix authentication is blocked and returns error 535 5.7.139, even though Authenticated SMTP and an app password were previously configured and working.
Verify that you have Microsoft 365 Global Administrator privileges, as you will need to access the Exchange admin center and potentially Microsoft Entra ID (formerly Azure AD) to configure new relay settings.
Configure a Microsoft 365 SMTP Relay Using an IP-based Connector
Set up an inbound connector to allow your Postfix server to securely relay emails through Microsoft 365 without relying on blocked legacy basic authentication.
Because Security Defaults strictly disable basic legacy authentication tenant-wide, standard SMTP auth with app passwords is no longer effective. Setting up an IP-based SMTP relay connector circumvents this limitation securely for on-premises or cloud servers with a static IP address.
Log in to the Microsoft 365 Exchange admin center using your administrator credentials.
Navigate to 'Mail flow' in the left-hand menu and select 'Connectors'. Click 'Add a connector'.
Select 'Your organization's email server' as the source, and 'Office 365' as the destination, then click 'Next'.
Choose the option to verify the sender by IP address, and enter the public static IP address of your Postfix server.
Modify your Postfix main.cf file to relay mail directly to your domain's MX endpoint (e.g., yourdomain-com.mail.protection.outlook.com) on port 25 instead of using smtp.office365.com.
Implement OAuth 2.0 for SMTP Submission
Upgrade your Postfix authentication mechanism to use modern OAuth 2.0 tokens, which are fully supported under Microsoft 365 Security Defaults.
Simplify Your Workflow with WPS Office
While troubleshooting complex Microsoft 365 administrative configurations and server errors like SASL auth failures, you can rely on WPS Office for a straightforward document productivity experience. WPS Office is a free, highly compatible alternative to Microsoft Office that lets you handle all your daily tasks without heavy enterprise management overhead.
- 1. Download the installer: Visit the official WPS Office website and click the free download button for your operating system.
- 2. Install the software: Run the downloaded installer and follow the on-screen instructions to complete the setup.
- 3. Start creating documents: Open WPS Office to instantly view, edit, or create documents with perfect Microsoft Office compatibility.
Frequently Asked Questions
Why does error 535 5.7.139 occur after enabling Security Defaults?
Microsoft 365 Security Defaults automatically block legacy authentication protocols to protect against compromised credentials. This includes the basic SMTP authentication used by older Postfix setups, resulting in the 535 5.7.139 error.
Can I bypass Security Defaults for a single mailbox in Microsoft 365?
No, Security Defaults apply to the entire tenant. If you need granular control to allow legacy authentication for specific accounts, you must disable Security Defaults and utilize Conditional Access policies, which require Azure AD Premium licenses.
Does an app password still work for SMTP auth if Security Defaults are on?
No. When Security Defaults are enabled, legacy authentication is strictly blocked tenant-wide. Consequently, app passwords will no longer work for SMTP client submission via smtp.office365.com.
What is the easiest way to allow a Linux server to send mail through Microsoft 365?
The easiest method, assuming your server has a static public IP, is to configure an IP-based inbound connector in the Exchange admin center. This allows mail relaying on port 25 without requiring any user authentication.
