Propagation is possible, not assumed
New Exchange authorization may take time to become effective. RelayBridge treats propagation as one possibility after validated administration; it does not classify every SMTP 535 as propagation and does not promise a completion time.
For the exact eligible Step 5 SMTP authentication denial, RelayBridge first performs up to four total attempts: the initial attempt, then retries after 2, 5, and 10 seconds while the same eligible condition persists.
Automatic session limits
If the short bounded sequence still receives the eligible SMTP 535, the active Step 5 page can start an automatic verification session.
| Control | Released behavior |
|---|---|
| Interval | Every five minutes |
| Attempt limit | 12 automatic attempts |
| Elapsed limit | One hour |
| Check now | Schedules one immediate check in the same session without overlapping work |
| Stop automatic checks | Stops future verification checks without canceling the setup candidate |
| Leave or close page | Disposes the page-scoped session and cancels its future checks |
| Candidate change | The session cannot adopt or activate a different candidate |
What each attempt does
Every attempt revalidates the candidate identity, revision, and fingerprint. It uses the existing certificate and application identity, performs no tenant mutation or permission broadening, and requires no additional administrator authentication.
While authentication is rejected, RelayBridge sends no MAIL, RCPT, or DATA. Once authentication succeeds, the normal verification path performs the existing final acceptance test and atomically activates the candidate.
If verification expires
Use the displayed safe error and Diagnostics to review tenant and mailbox SMTP AUTH policy, application identity, certificate validity, the Exchange service-principal reference, and effective RBAC scope.
Do not enable Basic Auth, grant broad Graph mail permissions, disable TLS validation, replace the candidate during an active session, or retry every SMTP 535 indefinitely.