Technical reference

Everything, precisely.

Written for whoever configures the equipment. If you just want your scanner working, the setup guide is the shorter road.

Connection Authentication TLS DNS records Limits Response codes Relaying from a server Data & retention

Connection

Hostname	mail.send25.net
Ports	25 · 587 · 465
Protocol	ESMTPPIPELINING, 8BITMIME, DSN, SMTPUTF8, CHUNKING and ENHANCEDSTATUSCODES are advertised.
Direction	Outbound onlyWe relay mail your systems send. We do not receive mail or host mailboxes.
Delivery	Direct to the recipient's mail serverNo third-party sending platform sits in the path.

Which port?

Port	Encryption	Authentication	Use it when
25	Optional (STARTTLS or none)	IP allow-list	Old equipment that can't authenticate, or can't do modern encryption.
587	STARTTLS required	Username & password	The default choice. Also the one to try when a provider blocks port 25.
465	Implicit TLS	Username & password	Devices that only offer "SSL" as an encryption option.

Blocked on port 25? Many internet providers block outbound 25 from business connections to limit spam. Port 587 is almost never blocked — try it first before assuming the device is at fault.

Authentication

Two methods. Both identify which account is sending, which is what lets us apply your limits and stop anyone sending as your domain.

IP allow-list	You give us the public IP address (or range) your equipment sends from; we recognise it and no credentials are needed.Only workable with a static address. Most small-business connections aren't truly static — if mail stops after months of working, this is the first thing to check.
Username & password	We issue one per device. Mechanisms offered are `PLAIN` and `LOGIN`, after STARTTLS.One credential per device is deliberate: a compromised scanner can be cut off without touching anything else.

The username is the whole string, including the @mail.send25.net part. Some device firmware silently truncates at the @ sign — if authentication fails on a device that looks correctly configured, check this.

Encryption

We deliberately accept what old equipment can actually speak, then re-send everything onward with modern encryption. Your copier's limitations stop at our front door.

Inbound (your devices)	TLS optional on port 25. Older TLS versions accepted. This is the whole point of the service. Nobody else will take these connections.
On 587 / 465	Encryption required.
Outbound (to recipients)	Opportunistic TLS — encrypted whenever the receiving server supports it, which in practice is nearly always.
Our certificate	Publicly trusted, issued by Let's Encrypt, renewed automatically.

DNS records

Three records on your domain. We generate the values and show you exactly what to paste, then check them against live DNS for you. This is what decides inbox versus junk.

Record	What it does	If it's missing
DKIMmr2026._domainkey	Lets us sign your mail cryptographically as your domain.	Mail can't prove it's really from you. This is the important one.
SPF@ (TXT)	Says our server is allowed to send for your domain.	Some receivers treat your mail as suspicious.
DMARC_dmarc	Tells receivers what to do with mail that fails the checks above, and where to send reports.	You lose visibility, and strict receivers get less confident in you.

Ownership is verified before anything sends. We also issue a one-time send25-verify=… TXT record. Until it's published and confirmed, your domain cannot send through us — that's what stops anyone signing up claiming a domain they don't own.

Limits

Message size	25 MBIncluding attachments. Comfortably more than a long duplex colour scan.
Recipients per message	1,000
Sending rate	Per-account hourly, daily and monthly limits, agreed with you. Sized to your normal traffic, so a device stuck in a loop is capped long before it becomes anyone else's problem.
When you reach a limit	Mail is held and retried, not discarded. Your device sees a temporary response and tries again later. We're alerted before you'd notice.

Held, not lost. Several large providers silently discard mail once you pass a quota. We don't — a temporary failure means your device retries and the message still arrives.

Response codes

What our server says, and what to do about it. Codes beginning 4 are temporary — the sender should retry. Codes beginning 5 are permanent.

Code	Message	What to do
235	Authentication successful	Nothing — credentials accepted.
250	Ok: queued as …	Accepted. Track it in Messages in your console.
451	Sending quota exceeded … will be accepted again when the window resets	You've hit your hourly, daily or monthly limit. The device will retry automatically. Contact us if the limit is too low for normal traffic.
535	Authentication failed	Wrong username or password, or the wrong auth type on the device. Check the username includes `@mail.send25.net`.
530	Must issue a STARTTLS command first	The device is on port 587 without encryption enabled. Turn on STARTTLS, or use port 25.
550	Recipient suppressed: this address previously reported a permanent delivery failure	That address hard-bounced before, so we stopped sending to it to protect your reputation. If it's valid again, remove it from your suppression list in the console.
553	You are not authorised to send as this domain	The From address uses a domain that isn't registered to your account — often a leftover default on the device. Set it to your own domain.
554	The From address must use a domain registered to your account	The visible From: header disagrees with the sending address. Make them the same domain.
554	Client host rejected: Access denied	The connection came from an address we don't recognise. Your office IP has probably changed — tell us the new one, or switch to a username and password.

Relaying from another mail server

If you run your own mail server and want it to hand outbound mail to us, here's the Postfix configuration. Other servers follow the same shape.

# /etc/postfix/main.cf
relayhost = [mail.send25.net]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_security_level = encrypt

# /etc/postfix/sasl_passwd
[mail.send25.net]:587  yourcredential@mail.send25.net:yourpassword

# then:
sudo postmap /etc/postfix/sasl_passwd
sudo chmod 600 /etc/postfix/sasl_passwd*
sudo systemctl reload postfix

Keep sasl_passwd readable only by root — it holds a password in plain text. postmap creates the hashed copy Postfix actually reads.

Data and retention

Where it runs	Our own hardware in St. John's, Newfoundland.Your mail doesn't leave the province on its way out.
What we keep	Delivery records — sender, recipient, time, size, and the outcome. Enough to answer "did that invoice go out on the 3rd?" — and only for the last 30 days.
What we don't keep	The contents of your messages.We relay them; we don't archive them.
How long	30 days, then deleted.A scheduled job removes anything older every night — it is enforced, not a policy we intend to follow. Long enough to settle a delivery question, short enough that we are not building a record of who you email.
Who can see it	You, for your own account. Every administrative action is recorded in an audit trail.

Request access Read the FAQ