Overview

Updated on 2026-08-13

Mailwerk is built for managed service providers and IT companies that look after mail for many customers at once. It comes in two parts: Mailwerk Relay, an agent that runs on a customer's own network, and the platform where you keep your customers, their sites and their agents.

The agent accepts classic SMTP with a username and password on the customer's LAN and delivers through that same customer's Microsoft 365 tenant over OAuth2, so scan-to-email and application mail keep working after Basic Authentication for SMTP AUTH is switched off.

Every site runs its own agent, and the site is also the unit that gets billed. The bill goes to whoever looks after the sites, whether that is a provider running them for customers or a company running its own. The prices are on the pricing page.

Microsoft switches Basic Auth for SMTP AUTH off by default in existing tenants at the end of December 2026. An administrator can switch it back on afterwards for the time being; the change is a new default, not yet a removal of the feature. In tenants created after that date, this authentication method is unavailable by default.

The obvious case is scan-to-email on a multifunction printer. The durable one is everything else that will never get OAuth-capable firmware: ERP and merchandise systems, monitoring and alerting, NAS boxes, POS systems, alarm panels, time tracking, old line-of-business software.

When you do not need us

Not every device needs an agent, and two of the ways around it come from Microsoft. Where a site has a static public IP address it shares with no other organisation, an inbound connector is enough. Where a device only sends to recipients inside its own customer's tenant, High Volume Email is the shorter route: an SMTP endpoint of its own that the December change does not touch, with no static address and no certificate. Both come with conditions worth knowing before you plan around them, and both are set out in full, alongside the other ways out, in the shutdown overview.

What works today

The mail path is complete and works end to end: SMTP ingress in three transport modes, a durable on-disk spool, a retrying queue with dead-lettering, and delivery through Microsoft Graph including the automatic switch to an upload session for large scans.

The platform is not built yet. There is no enrolment of an agent against a site, no view across every customer, no remote configuration, no alert when an agent stops delivering, and no billing. An agent is therefore set up locally, on the command line, and that is the state these pages describe. What changes once enrolment arrives is in the quick start, and we will describe the interface once there is one.

Google Workspace is intended as a later step and is not part of the first release.