Architecture
RelayBridge v1.0 targets Microsoft 365 / Exchange Online. Your existing devices keep using the SMTP they understand while RelayBridge handles the current Microsoft identity and transport requirements they cannot.
Legacy devices send ordinary SMTP on the trusted local network.
RelayBridge restricts intake, preserves the message, and persists it locally.
A local certificate identifies RelayBridge to Microsoft Entra.
Exchange Online SMTP accepts the message over TLS using XOAUTH2.
RelayBridge separates a deliberately constrained local SMTP boundary from the modern Microsoft 365 submission boundary.
A configured device connects to RelayBridge from an explicitly trusted private-network address. Device-level restrictions define what it may submit. Inbound STARTTLS is not currently available, so this boundary must remain on a trusted network.
The raw MIME payload is written locally, while SQLite retains queue metadata. RelayBridge reports local acceptance only after the durable persistence boundary is reached. Temporary failures are retried, including after an unexpected restart.
RelayBridge uses a dedicated Entra application and a locally held certificate private key to obtain an Exchange resource token. There is no permanent client secret in the design.
RelayBridge connects to Microsoft 365 SMTP using mandatory TLS and XOAUTH2. Microsoft Graph is not used as the mail-delivery transport. Success means Microsoft 365 returned the final successful SMTP response—not that the message reached an inbox.
Trust the details
See the identity model, permission scope, queue boundary, current limitations, and explicit non-goals.