Two separate SMTP connections
device or application
→ private-LAN SMTP listener
→ streamed incoming spool
→ durable flush and pending promotion
→ SQLite queue metadata commit
→ local SMTP 250
→ bounded queue claim and Microsoft token
→ STARTTLS + XOAUTH2 to smtp.office365.com:587
→ recipients, original MIME payload, final Exchange responseThe device-facing connection and Microsoft-facing connection are independent. A legacy device does not gain OAuth or TLS capability; RelayBridge owns a separate modern connection upstream.
What durable local acceptance means
During SMTP DATA, RelayBridge streams the original RFC 5322/MIME payload into spool\incoming, durably flushes it, atomically promotes it to spool\pending, commits SQLite metadata, and only then returns local SMTP 250.
That response means RelayBridge owns a durable copy on this Windows host. Queue data and messages survive a normal service restart or Windows reboot. It does not mean Exchange Online or a recipient inbox has accepted the message.
Microsoft delivery attempt
- Validate current configuration and sender.The worker refuses to deliver through an invalid or unready Microsoft configuration.
- Acquire an application token.The Windows service uses the customer-owned Entra application and local certificate private key.
- Connect to Exchange Online.RelayBridge uses the fixed SMTP endpoint on TCP 587.
- Require STARTTLS.Normal platform certificate and hostname validation must succeed.
- Authenticate with XOAUTH2.RelayBridge does not use Basic Auth and does not fall back to Graph mail delivery.
- Submit all recipients and the original payload.The worker streams MIME with SMTP dot-stuffing and waits for the final Exchange response.
Acceptance, retries, and duplicates
Only the final Exchange 250 marks the queue item delivered. It proves Microsoft accepted the SMTP transaction; it does not guarantee inbox placement, downstream delivery, or the absence of later Microsoft filtering or policy handling.
The worker uses bounded concurrency, retry delay with jitter, maximum attempt and age policies, and permanent-failure classification. Startup reconciliation repairs safe database/spool inconsistencies before work resumes. Successfully delivered payloads are deleted under the default policy.
If a connection fails after the DATA terminator but before RelayBridge receives Exchange's final response, the result is ambiguous. RelayBridge may retry, so duplicates remain possible. Exactly-once delivery is not promised.